Skip to navigation

Security Advisory Critical: thunderbird security update

Advisory: RHSA-2012:0085-1
Type: Security Advisory
Severity: Critical
Issued on: 2012-02-01
Last updated on: 2012-02-01
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2011-3670
CVE-2012-0442

Details

An updated thunderbird package that fixes two security issues is now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A flaw was found in the processing of malformed content. An HTML mail
message containing malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code with the privileges of the user running
Thunderbird. (CVE-2012-0442)

The same-origin policy in Thunderbird treated http://example.com and
http://[example.com] as interchangeable. A malicious script could possibly
use this flaw to gain access to sensitive information (such as a client's
IP and user e-mail address, or httpOnly cookies) that may be included in
HTTP proxy error replies, generated in response to invalid URLs using
square brackets. (CVE-2011-3670)

Note: The CVE-2011-3670 issue cannot be exploited by a specially-crafted
HTML mail message as JavaScript is disabled by default for mail messages.
It could be exploited another way in Thunderbird, for example, when viewing
the full remote content of an RSS feed.

All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-2.0.0.24-28.el5_7.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 04cc21104bb79dbaa975d2383a7a1351
SHA-256: 77fd6159476717cf61b56a13438d5edecbb8d925abe6e1bb446686226793468f
 
IA-32:
thunderbird-2.0.0.24-28.el5_7.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 22ba7f585a44dea1fbb9c1cb424b67ed
SHA-256: a2c4266b82772c3ec98e3dc7cc5ccc57e0184c9781fd8a2a83d9fe96df3cb73f
 
x86_64:
thunderbird-2.0.0.24-28.el5_7.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 48190d55667d451c50d561df7647d1de
SHA-256: 2685dbe45a8ba33736e646a064be786c376c416f65f66a73efe8b8f45e53d32f
 
Red Hat Desktop (v. 4)

SRPMS:
thunderbird-1.5.0.12-46.el4.src.rpm     MD5: 7206b62918e149b944cd1bd37f3d761e
SHA-256: ba00d48a37bf495a2c17d6191a8979c75a67150f6ffd48945047948c45b8d83a
 
IA-32:
thunderbird-1.5.0.12-46.el4.i386.rpm     MD5: 90537c10303b4b14137269b58b0b6c07
SHA-256: 5912dedafd27880df1b22210c4161af7e78671380f0834c0adf571a9293704ac
 
x86_64:
thunderbird-1.5.0.12-46.el4.x86_64.rpm     MD5: c795a79f0321b7e81dd762e9d1912bf8
SHA-256: b56f532ebd209bd122717f3235294753ba641ea8448421ea4d313e52d29befdc
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
thunderbird-1.5.0.12-46.el4.src.rpm     MD5: 7206b62918e149b944cd1bd37f3d761e
SHA-256: ba00d48a37bf495a2c17d6191a8979c75a67150f6ffd48945047948c45b8d83a
 
IA-32:
thunderbird-1.5.0.12-46.el4.i386.rpm     MD5: 90537c10303b4b14137269b58b0b6c07
SHA-256: 5912dedafd27880df1b22210c4161af7e78671380f0834c0adf571a9293704ac
 
IA-64:
thunderbird-1.5.0.12-46.el4.ia64.rpm     MD5: 7a4f424038fbe9467df8ce23a7482927
SHA-256: 47c375fc47cd9f740ef62f38d33be24ecd77de8a210f1add7d05cd399e6624dc
 
PPC:
thunderbird-1.5.0.12-46.el4.ppc.rpm     MD5: bfaff27cc13843d18c730203f9e7065c
SHA-256: b508fcb71bbf5f75500fc27fdf439072c7eb96a90939cdf6ff153239a34cdf2a
 
s390:
thunderbird-1.5.0.12-46.el4.s390.rpm     MD5: a8b847bf2102c923a525e7c24662c3fd
SHA-256: b4e6a0f090f86ed6622453758744def1d9b82fbdd82804e6b82798ce9dad0cd4
 
s390x:
thunderbird-1.5.0.12-46.el4.s390x.rpm     MD5: 06e7948b089780b4440866696f42f982
SHA-256: 822f07973e093cecfd9a272c7de89b5f458ebb973dd704c9223a120d36603bec
 
x86_64:
thunderbird-1.5.0.12-46.el4.x86_64.rpm     MD5: c795a79f0321b7e81dd762e9d1912bf8
SHA-256: b56f532ebd209bd122717f3235294753ba641ea8448421ea4d313e52d29befdc
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-2.0.0.24-28.el5_7.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 04cc21104bb79dbaa975d2383a7a1351
SHA-256: 77fd6159476717cf61b56a13438d5edecbb8d925abe6e1bb446686226793468f
 
IA-32:
thunderbird-2.0.0.24-28.el5_7.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 22ba7f585a44dea1fbb9c1cb424b67ed
SHA-256: a2c4266b82772c3ec98e3dc7cc5ccc57e0184c9781fd8a2a83d9fe96df3cb73f
 
x86_64:
thunderbird-2.0.0.24-28.el5_7.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 48190d55667d451c50d561df7647d1de
SHA-256: 2685dbe45a8ba33736e646a064be786c376c416f65f66a73efe8b8f45e53d32f
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
thunderbird-1.5.0.12-46.el4.src.rpm     MD5: 7206b62918e149b944cd1bd37f3d761e
SHA-256: ba00d48a37bf495a2c17d6191a8979c75a67150f6ffd48945047948c45b8d83a
 
IA-32:
thunderbird-1.5.0.12-46.el4.i386.rpm     MD5: 90537c10303b4b14137269b58b0b6c07
SHA-256: 5912dedafd27880df1b22210c4161af7e78671380f0834c0adf571a9293704ac
 
IA-64:
thunderbird-1.5.0.12-46.el4.ia64.rpm     MD5: 7a4f424038fbe9467df8ce23a7482927
SHA-256: 47c375fc47cd9f740ef62f38d33be24ecd77de8a210f1add7d05cd399e6624dc
 
x86_64:
thunderbird-1.5.0.12-46.el4.x86_64.rpm     MD5: c795a79f0321b7e81dd762e9d1912bf8
SHA-256: b56f532ebd209bd122717f3235294753ba641ea8448421ea4d313e52d29befdc
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
thunderbird-1.5.0.12-46.el4.src.rpm     MD5: 7206b62918e149b944cd1bd37f3d761e
SHA-256: ba00d48a37bf495a2c17d6191a8979c75a67150f6ffd48945047948c45b8d83a
 
IA-32:
thunderbird-1.5.0.12-46.el4.i386.rpm     MD5: 90537c10303b4b14137269b58b0b6c07
SHA-256: 5912dedafd27880df1b22210c4161af7e78671380f0834c0adf571a9293704ac
 
IA-64:
thunderbird-1.5.0.12-46.el4.ia64.rpm     MD5: 7a4f424038fbe9467df8ce23a7482927
SHA-256: 47c375fc47cd9f740ef62f38d33be24ecd77de8a210f1add7d05cd399e6624dc
 
x86_64:
thunderbird-1.5.0.12-46.el4.x86_64.rpm     MD5: c795a79f0321b7e81dd762e9d1912bf8
SHA-256: b56f532ebd209bd122717f3235294753ba641ea8448421ea4d313e52d29befdc
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-like hostname syntax (MFSA 2012-02)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/