來自 Red Hat 安全性公告 2016:1809：

現已提供適用於 Red Hat Enterprise Linux 5、Red Hat Enterprise Linux 6 與 Red Hat Enterprise Linux 7 的 thunderbird 更新。

Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

Mozilla Thunderbird 是獨立式郵件與新聞群組用戶端。

此更新會將 Thunderbird 升級至 45.3.0 版。

安全性修正：

* 在處理格式錯誤的 Web 內容過程中發現多個瑕疵。包含惡意內容的網頁可導致 Thunderbird 損毀，或可能利用執行 Thunderbird 之使用者的權限來執行任意程式碼。(CVE-2016-2836)

Red Hat 要感謝 Mozilla 專案報告這些問題。上游確認 Carsten Book、Christian Holler、Gary Kwong、Jesse Ruderman、Andrew McCreight、Phil Ringnalda 和 Philipp 為原始報告者。

此更新會將 Thunderbird 升級至 45.3.0 版。安全性修正：- 在處理格式錯誤的 Web 內容過程中發現多個缺陷。包含惡意內容的網頁可導致 Thunderbird 損毀，或可能利用執行 Thunderbird 之使用者的權限來執行任意程式碼。(CVE-2016-2836)

Christian Holler、Carsten Book、Gary Kwong, Jesse Ruderman、Andrew McCreight 和 Phil Ringnalda 在 Thunderbird 中發現多個記憶體安全問題。如果使用者遭誘騙而開啟特製訊息，攻擊者可能惡意利用這些弱點，透過應用程式損毀造成拒絕服務或執行任意程式碼。
(CVE-2016-2836).

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 Debian 版的 Mozilla Thunderbird 郵件用戶端 Icedove 中發現多個安全性問題：多個記憶體安全錯誤可能導致執行任意程式碼或拒絕服務。

針對 Debian 7「Wheezy」，已在 1:45.3.0-1~deb7u1 版本中修正這些問題。

建議您升級 icedove 套件。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 Debian 版的 Mozilla Thunderbird 郵件用戶端 Icedove 中發現多個安全性問題：多個記憶體安全錯誤可能導致執行任意程式碼或拒絕服務。

此 MozillaThunderbird 更新可修正下列問題：

- Thunderbird 45.3.0 的更新 (boo#991809)

- 不可在 mail.compose.other.header 中使用 Disposition-Notification-To

- 在收到的訊息中，「編輯新訊息」功能預先將撰寫者填入為寄件人。

- 特定訊息造成草稿摘要資料庫損毀。安全性修正：

- MFSA 2016-62/CVE-2016-2836 其他記憶體安全危險

- MFSA 2016-63/CVE-2016-2830 (bmo#1255270) 頁面關閉時 Favicon 網路連線可持續

- MFSA 2016-64/CVE-2016-2838 (bmo#1279814) 轉譯具雙向內容的 SVG 時發生緩衝區溢位

- MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo 轉譯因 FFmpeg 0.10 的記憶體配置問題而損毀

- MFSA 2016-67/CVE-2016-5252 (bmo#1268854) 2D 圖形轉譯期間發生堆疊反向溢位

- MFSA 2016-70/CVE-2016-5254 (bmo#1266963) 使用 alt 鍵和頂層功能表時出現釋放後使用

- MFSA 2016-72/CVE-2016-5258 (bmo#1279146) WebRTC 工作階段關閉期間 DTLS 出現釋放後使用

- MFSA 2016-73/CVE-2016-5259 (bmo#1282992) 含有巢狀同步事件的服務背景工作出現釋放後使用

- MFSA 2016-76/CVE-2016-5262 (bmo#1277475) marquee 標籤上的指令碼可在沙箱 iframe 中執行

- MFSA 2016-77/CVE-2016-2837 (bmo#1274637) 播放視訊期間 ClearKey 內容解密模組 (CDM) 發生緩衝區溢位

- MFSA 2016-78/CVE-2016-5263 (bmo#1276897) 顯示轉換過程發生類型混淆

- MFSA 2016-79/CVE-2016-5264 (bmo#1286183) 套用 SVG 效果時發生釋放後使用

- MFSA 2016-80/CVE-2016-5265 (bmo#1278013) 使用本機 HTML 檔案和已儲存的捷徑檔案時發生同源原則違規

- 可能發生的緩衝區滿溢之修正 (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

- 為 appdata.xml 新增一個螢幕擷取畫面

Versions of Mozilla Firefox ESR less than or equal to 45.2 are unpatched for the following vulnerabilities :

 - A flaw exists due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. 
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists in 'dom/media/GraphDriver.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-2837)
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.(CVE-2016-5254)
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling 'DTLS' objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5258)
 - A flaw exists that is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms. (CVE-2016-5262)
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5264)

Versions of Mozilla Firefox prior to 48.0 are unpatched for the following vulnerabilities :

 - A flaw is triggered as certain input is not properly validated when handling the 'BitmapInfoHeader' in icons. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/frontend/Parser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'js::array_splice_impl()' function in 'js/src/jsarray.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw is triggered as certain unspecified user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'OSXNotificationCenter::ShowAlertWithIconData()' function in 'widget/cocoa/OSXNotificationCenter.mm' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'Http2Session::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/Http2Session.cpp' and 'SpdySession31::TransactionHasDataToWrite()' function in 'netwerk/protocol/http/SpdySession31.cpp'. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A flaw exists in the 'Assembler::bind()' function in 'js/src/jit/arm/Assembler-arm.cpp' that is triggered when handling certain labels. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'CodeGeneratorShared::assignBailoutId()' function in 'js/src/jit/shared/CodeGenerator-shared.cpp' that is triggered when handling allocation errors. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in 'woff2_dec.cc' that is triggered as certain input is not properly validated when decompressing files. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'SetPaintPattern()' function in 'gfx/2d/DrawTargetSkia.cpp' that is triggered when handling gradients with non-finite endpoints. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'PeerConnectionMedia::ProtocolProxyQueryHandler::OnProxyAvailable()' function in 'media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'media/mtransport/nr_timer.cpp' that is triggered when handling timers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A race condition exists in the 'MatchKeyHash()' function in 'security/pkix/lib/pkixocsp.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'ClearKeyDecryptor::Decrypt()' function in 'media/gmp-clearkey/0.1/ClearKeyDecryptionManager.cpp' used by the Encrypted Media Extensions (EME) API. The issue is triggered as user-supplied input is not properly validated when handling video files. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw is triggered as file URIs dragged from a web page to a different piece of software failed to have the contents properly filtered. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw is triggered when handling right-to-left character sets with left-to-right character sets. This may allow a context-dependent attacker to spoof the address bar.
 - A flaw is triggered when handling certain specific 'about:' URLs. This may allow a context-dependent attacker to spoof the contents of system information or error messages.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' due to the program leaking potentially sensitive resources of URLs through the Resource Timing API during page navigation. This may allow a context-dependent attacker to potentially disclose sensitive information.
 - An integer overflow condition exists in the 'WebSocketChannel::ProcessInput()' function in 'netwerk/protocol/websocket/WebSocketChannel.cpp'. The issue is triggered as user-supplied input is not properly validated when handling specially crafted 'WebSocketChannel' packets. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists in the 'nsNodeUtils::NativeAnonymousChildListChange()' function. The issue is triggered when applying effects to SVG element. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'js::PreliminaryObjectArray::sweep()' function in JavaScript. The issue is triggered when handling objects and pointers during incremental garbage collection. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'WebRTC'. The issue is triggered when handling DTLS objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the r'estorableFormNodes()' function in 'toolkit/modules/sessionstore/XPathGenerator.jsm' that is due to the program persistently storing passwords in in plaintext in session restore data. This may allow a context-dependent attacker to potentially gain access to password information.
 - A use-after-free error exists in the 'WorkerPrivate::DestroySyncLoop()' function in 'dom/workers/WorkerPrivate.cpp'. The issue is triggered when handling nested sync event loops in Service Workers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'nsDisplayList::HitTest()' function in 'layout/base/nsDisplayList.cpp' that is triggered during the handling of display transformations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'nsBaseChannel::Redirect()' function in 'netwerk/base/nsBaseChannel.cpp' that is triggered when a malicious shortcut is called from the same directory as a local HTML file. This may allow a local attacker to bypass the same-origin policy.
 - An underflow condition exists in the 'mozilla::gfx::BasePoint4d()' function in 'gfx/2d/Matrix.h'. The issue is triggered as user-supplied input is not properly validated when calculating clipping regions in 2D graphics. This may allow a context-dependent attacker to cause a stack buffer underflow, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'nsBidi::BracketData::ProcessPDI()' function in 'layout/base/nsBidi.cpp'. The issue is triggered as user-supplied input is not properly validated when rendering SVG format graphics with directional content. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'Cairo' graphics layer that is triggered when allocating the 'LibAV' header during video decoding. This may allow a context-dependent attacker to crash the Cairo graphics layer.
 - A flaw is due to event handler attributes on a 'marquee' tag being executed inside a sandboxed iframe that does not have the allow-scripts flag set. This may allow a context-dependent attacker to bypass XSS protection mechanisms.
 - A flaw is due to the program failing to close connections after requesting favicons. This may allow a context-dependent attacker to continue to send requests to the user's browser and gain access to potentially sensitive information.
 - A use-after-free error exists in the 'nsXULPopupManager::KeyDown()' function in 'layout/xul/nsXULPopupManager.cpp'. The issue is triggered when using the alt key in conjunction with top level menu items in Firefox. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw is triggered when decoding url-encoded values in 'data:' URLs. This may allow a context-dependent attacker to use non-ASCII or emoji characters to spoof the address bar.
 - A flaw exists in 'toolkit/mozapps/update/updater/updater.cpp' that is due to the 'Updater', when opened using the callback application path parameter, creating a copy of a user specified file as a callback file with a locked hardlink. This may allow a local attacker to run the target file and gain elevated privileges.
 - An unspecified flaw exists that is triggered during the handling of TTC detection. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - An out-of-bounds access flaw exists in the 'ReconstructTransformedHmtx()' function in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that may allow a context-dependent attacker to have an unspecified impact.
 - An unspecified flaw exists in 'woff2_dec.cc' that is triggered during memory allocation, which may allow a context-dependent attacker to crash a process linked against the library.

ID	Name	Product	Family	Published	Updated	Severity
93338	Oracle Linux 6 / 7 : thunderbird (ELSA-2016-1809)	Nessus	Oracle Linux Local Security Checks	9/6/2016	10/22/2024	high
93366	Scientific Linux 安全性更新：SL5.x、SL6.x、SL7.x i386/x86_64 上的 thunderbird	Nessus	Scientific Linux Local Security Checks	9/8/2016	1/14/2021	high
93682	Ubuntu 14.04 LTS / 16.04 LTS：thunderbird 弱點 (USN-3073-1)	Nessus	Ubuntu Local Security Checks	9/23/2016	8/27/2024	high
93831	Debian DLA-640-1：icedove 安全性更新	Nessus	Debian Local Security Checks	10/4/2016	1/11/2021	high
93849	Debian DSA-3686-1：icedove - 安全性更新	Nessus	Debian Local Security Checks	10/5/2016	1/11/2021	high
93363	openSUSE 安全性更新：MozillaThunderbird (openSUSE-2016-1057)	Nessus	SuSE Local Security Checks	9/8/2016	1/19/2021	critical
9485	Mozilla Firefox ESR < 45.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/26/2016	11/6/2019	medium
9484	Mozilla Firefox < 48.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/26/2016	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

medium

medium