Skip to navigation

Security Advisory Moderate: thunderbird security update

Advisory: RHSA-2010:0780-1
Type: Security Advisory
Severity: Moderate
Issued on: 2010-10-19
Last updated on: 2010-10-19
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.8.z)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.8.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2010-3176
CVE-2010-3180
CVE-2010-3182

Details

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed HTML mail content.
An HTML mail message containing malicious content could cause Thunderbird
to crash or, potentially, execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2010-3176, CVE-2010-3180)

Note: JavaScript support is disabled by default in Thunderbird. The above
issues are not exploitable unless JavaScript is enabled.

A flaw was found in the script that launches Thunderbird. The
LD_LIBRARY_PATH variable was appending a "." character, which could allow a
local attacker to execute arbitrary code with the privileges of a different
user running Thunderbird, if that user ran Thunderbird from within an
attacker-controlled directory. (CVE-2010-3182)

All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-2.0.0.24-9.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 212830fec39ad1e5c1d428e99c8fd6c3
SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
 
IA-32:
thunderbird-2.0.0.24-9.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: fe4d288e8ebcadf93db3f9588855e51b
SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f
 
x86_64:
thunderbird-2.0.0.24-9.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 2e159aeeb311c900ea3ed37057a7e1bc
SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
 
Red Hat Desktop (v. 4)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
IA-64:
thunderbird-1.5.0.12-31.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 880f8ec89a9c59a9b2e8147b95e0ff57
SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
 
PPC:
thunderbird-1.5.0.12-31.el4.ppc.rpm
File outdated by:  RHSA-2012:0085
    MD5: f1049923b3e5875faf975886394affd6
SHA-256: 1c988189f42fc17fe4f0543df69eafca99026d12c9e65de15a059dee7e0f2d50
 
s390:
thunderbird-1.5.0.12-31.el4.s390.rpm
File outdated by:  RHSA-2012:0085
    MD5: c8f5034474279472af2d83f2c00c60ed
SHA-256: cf0b15d1a4b271fd2f784ad5667f991581f84d24d73b1aad3a44ffd7f5874e65
 
s390x:
thunderbird-1.5.0.12-31.el4.s390x.rpm
File outdated by:  RHSA-2012:0085
    MD5: 7b528941e6a5c10409984e657da19ce3
SHA-256: 05c6a981bdeed8fa4af1d0c9cbc4a8ad584c5e082868a5c23f4fed90ea8cd7c8
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
Red Hat Enterprise Linux AS (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2011:0887
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
IA-64:
thunderbird-1.5.0.12-31.el4.ia64.rpm
File outdated by:  RHSA-2011:0887
    MD5: 880f8ec89a9c59a9b2e8147b95e0ff57
SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
 
PPC:
thunderbird-1.5.0.12-31.el4.ppc.rpm
File outdated by:  RHSA-2011:0887
    MD5: f1049923b3e5875faf975886394affd6
SHA-256: 1c988189f42fc17fe4f0543df69eafca99026d12c9e65de15a059dee7e0f2d50
 
s390:
thunderbird-1.5.0.12-31.el4.s390.rpm
File outdated by:  RHSA-2011:0887
    MD5: c8f5034474279472af2d83f2c00c60ed
SHA-256: cf0b15d1a4b271fd2f784ad5667f991581f84d24d73b1aad3a44ffd7f5874e65
 
s390x:
thunderbird-1.5.0.12-31.el4.s390x.rpm
File outdated by:  RHSA-2011:0887
    MD5: 7b528941e6a5c10409984e657da19ce3
SHA-256: 05c6a981bdeed8fa4af1d0c9cbc4a8ad584c5e082868a5c23f4fed90ea8cd7c8
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2011:0887
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-2.0.0.24-9.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 212830fec39ad1e5c1d428e99c8fd6c3
SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
 
IA-32:
thunderbird-2.0.0.24-9.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: fe4d288e8ebcadf93db3f9588855e51b
SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f
 
x86_64:
thunderbird-2.0.0.24-9.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 2e159aeeb311c900ea3ed37057a7e1bc
SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
IA-64:
thunderbird-1.5.0.12-31.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 880f8ec89a9c59a9b2e8147b95e0ff57
SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
Red Hat Enterprise Linux ES (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2011:0887
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
IA-64:
thunderbird-1.5.0.12-31.el4.ia64.rpm
File outdated by:  RHSA-2011:0887
    MD5: 880f8ec89a9c59a9b2e8147b95e0ff57
SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2011:0887
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
thunderbird-1.5.0.12-31.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 31b9eb63baeaf66d1c136f14d8efd850
SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
 
IA-32:
thunderbird-1.5.0.12-31.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: cc277d9ac62718780426832560a94a70
SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
 
IA-64:
thunderbird-1.5.0.12-31.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 880f8ec89a9c59a9b2e8147b95e0ff57
SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
 
x86_64:
thunderbird-1.5.0.12-31.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: c08b1c88ad523517e22d7e4c3bf4d22d
SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

642272 - CVE-2010-3176 Mozilla miscellaneous memory safety hazards
642283 - CVE-2010-3180 Mozilla use-after-free error in nsBarProp
642300 - CVE-2010-3182 Mozilla unsafe library loading flaw


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/