Skip to navigation

Security Advisory Moderate: thunderbird security update

Advisory: RHSA-2010:0682-1
Type: Security Advisory
Severity: Moderate
Issued on: 2010-09-07
Last updated on: 2010-09-07
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.8.z)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.8.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2010-2760
CVE-2010-2765
CVE-2010-2767
CVE-2010-2768
CVE-2010-3167
CVE-2010-3168
CVE-2010-3169

Details

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed HTML mail content.
An HTML mail message containing malicious content could cause Thunderbird
to crash or, potentially, execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2010-3169)

A buffer overflow flaw was found in Thunderbird. An HTML mail message
containing malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code with the privileges of the user running
Thunderbird. (CVE-2010-2765)

A use-after-free flaw and several dangling pointer flaws were found in
Thunderbird. An HTML mail message containing malicious content could cause
Thunderbird to crash or, potentially, execute arbitrary code with the
privileges of the user running Thunderbird. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167, CVE-2010-3168)

A cross-site scripting (XSS) flaw was found in Thunderbird. Remote HTML
content could cause Thunderbird to execute JavaScript code with the
permissions of different remote HTML content. (CVE-2010-2768)

Note: JavaScript support is disabled by default in Thunderbird. None of the
above issues are exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-2.0.0.24-8.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 541be92b67812cf153ebde802c5b248a
SHA-256: c3d952be51074db11c329d270911e8e5925c7b07b09a0fd219dcb0cb38f39408
 
IA-32:
thunderbird-2.0.0.24-8.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 4da93e3b7cbb56686575a193df580b63
SHA-256: fb60fcbe794f4b237c5fc74d8de9af1a323caffec26c7c712a4d94de51e41258
 
x86_64:
thunderbird-2.0.0.24-8.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0b4bf930abfe883be217fd4754d93c32
SHA-256: 3bb5e301c2e8225a80b6eca65740bf3e905b328db85771be61c6d3e02455409f
 
Red Hat Desktop (v. 4)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
IA-64:
thunderbird-1.5.0.12-30.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: eba43b70c26b9bed91e784792a8db0bb
SHA-256: f71a13d12fcd00ea0c61ba623c958e0864bb87a95c01a2327df29dcf2ed3416a
 
PPC:
thunderbird-1.5.0.12-30.el4.ppc.rpm
File outdated by:  RHSA-2012:0085
    MD5: c3a28a8822b807405422393eb36defc0
SHA-256: e5b313a80556510a0777cbe60496a209dd2dc359ce8b05e9d8020187f3c7b68e
 
s390:
thunderbird-1.5.0.12-30.el4.s390.rpm
File outdated by:  RHSA-2012:0085
    MD5: 2012aa0c5555d657dca938378f62aa75
SHA-256: 87cbc909d89ae594980f184cd2cdfc5e3a7f14e7e603e3e88a9fd465b719a065
 
s390x:
thunderbird-1.5.0.12-30.el4.s390x.rpm
File outdated by:  RHSA-2012:0085
    MD5: 927d37a02f35eefbf1e0510b3b9dc5e2
SHA-256: f3f40610569c3f410deeb96ed44c136122360179047a34dba9b39e8ebfb58f11
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
Red Hat Enterprise Linux AS (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2011:0887
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
IA-64:
thunderbird-1.5.0.12-30.el4.ia64.rpm
File outdated by:  RHSA-2011:0887
    MD5: eba43b70c26b9bed91e784792a8db0bb
SHA-256: f71a13d12fcd00ea0c61ba623c958e0864bb87a95c01a2327df29dcf2ed3416a
 
PPC:
thunderbird-1.5.0.12-30.el4.ppc.rpm
File outdated by:  RHSA-2011:0887
    MD5: c3a28a8822b807405422393eb36defc0
SHA-256: e5b313a80556510a0777cbe60496a209dd2dc359ce8b05e9d8020187f3c7b68e
 
s390:
thunderbird-1.5.0.12-30.el4.s390.rpm
File outdated by:  RHSA-2011:0887
    MD5: 2012aa0c5555d657dca938378f62aa75
SHA-256: 87cbc909d89ae594980f184cd2cdfc5e3a7f14e7e603e3e88a9fd465b719a065
 
s390x:
thunderbird-1.5.0.12-30.el4.s390x.rpm
File outdated by:  RHSA-2011:0887
    MD5: 927d37a02f35eefbf1e0510b3b9dc5e2
SHA-256: f3f40610569c3f410deeb96ed44c136122360179047a34dba9b39e8ebfb58f11
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2011:0887
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-2.0.0.24-8.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 541be92b67812cf153ebde802c5b248a
SHA-256: c3d952be51074db11c329d270911e8e5925c7b07b09a0fd219dcb0cb38f39408
 
IA-32:
thunderbird-2.0.0.24-8.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 4da93e3b7cbb56686575a193df580b63
SHA-256: fb60fcbe794f4b237c5fc74d8de9af1a323caffec26c7c712a4d94de51e41258
 
x86_64:
thunderbird-2.0.0.24-8.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0b4bf930abfe883be217fd4754d93c32
SHA-256: 3bb5e301c2e8225a80b6eca65740bf3e905b328db85771be61c6d3e02455409f
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
IA-64:
thunderbird-1.5.0.12-30.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: eba43b70c26b9bed91e784792a8db0bb
SHA-256: f71a13d12fcd00ea0c61ba623c958e0864bb87a95c01a2327df29dcf2ed3416a
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
Red Hat Enterprise Linux ES (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2011:0887
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
IA-64:
thunderbird-1.5.0.12-30.el4.ia64.rpm
File outdated by:  RHSA-2011:0887
    MD5: eba43b70c26b9bed91e784792a8db0bb
SHA-256: f71a13d12fcd00ea0c61ba623c958e0864bb87a95c01a2327df29dcf2ed3416a
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2011:0887
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
thunderbird-1.5.0.12-30.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 66e485acdc04dec2976dcadced1dd568
SHA-256: 3335d18e8d34851d0bc2ac79ab5af72f085482b564ac25ce6dc65a9abaadb416
 
IA-32:
thunderbird-1.5.0.12-30.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 06061f891f631e84df1daafbe2d4a5b1
SHA-256: 299096591edb41579eeffbbc0ae5bb150a3fc133e0780eb1ddbbfbf9964d6bf7
 
IA-64:
thunderbird-1.5.0.12-30.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: eba43b70c26b9bed91e784792a8db0bb
SHA-256: f71a13d12fcd00ea0c61ba623c958e0864bb87a95c01a2327df29dcf2ed3416a
 
x86_64:
thunderbird-1.5.0.12-30.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 8ff14c6cd98a429c79e14a341989c367
SHA-256: ee19653cb2f18e06128eccf9cb63356c1b9254f026693d25dcca710b0172a677
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

630055 - CVE-2010-3169 Mozilla Miscellaneous memory safety hazards
630056 - CVE-2010-2765 Mozilla Frameset integer overflow vulnerability (MFSA 2010-50)
630059 - CVE-2010-2767 Mozilla Dangling pointer vulnerability using DOM plugin array (MFSA 2010-51)
630062 - CVE-2010-2760 Mozilla Dangling pointer vulnerability in nsTreeSelection (MFSA 2010-54)
630064 - CVE-2010-3168 Mozilla XUL tree removal crash and remote code execution (MFSA 2010-55)
630067 - CVE-2010-3167 Mozilla Dangling pointer vulnerability in nsTreeContentView (MFSA 2010-56)
630074 - CVE-2010-2768 Mozilla UTF-7 XSS by overriding document charset using <object> type attribute (MFSA 2010-61)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/