Skip to navigation

Security Advisory Critical: thunderbird security update

Advisory: RHSA-2011:0887-1
Type: Security Advisory
Severity: Critical
Issued on: 2011-06-21
Last updated on: 2011-06-21
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
RHEL Optional Productivity Applications EUS (v. 5.6.z server)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.8.z)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.8.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2011-0083
CVE-2011-0085
CVE-2011-2362
CVE-2011-2363
CVE-2011-2364
CVE-2011-2365
CVE-2011-2371
CVE-2011-2373
CVE-2011-2374
CVE-2011-2375
CVE-2011-2376
CVE-2011-2377
CVE-2011-2605

Details

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A flaw was found in the way Thunderbird handled malformed JPEG images. An
HTML mail message containing a malicious JPEG image could cause Thunderbird
to crash or, potentially, execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2011-2377)

Multiple dangling pointer flaws were found in Thunderbird. Malicious HTML
content could cause Thunderbird to crash or, potentially, execute arbitrary
code with the privileges of the user running Thunderbird. (CVE-2011-0083,
CVE-2011-0085, CVE-2011-2363)

Several flaws were found in the processing of malformed HTML content.
Malicious HTML content could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running Thunderbird.
(CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376)

An integer overflow flaw was found in the way Thunderbird handled
JavaScript Array objects. Malicious content could cause Thunderbird to
execute JavaScript with the privileges of the user running Thunderbird.
(CVE-2011-2371)

A use-after-free flaw was found in the way Thunderbird handled malformed
JavaScript. Malicious content could cause Thunderbird to execute JavaScript
with the privileges of the user running Thunderbird. (CVE-2011-2373)

It was found that Thunderbird could treat two separate cookies (for web
content) as interchangeable if both were for the same domain name but one
of those domain names had a trailing "." character. This violates the
same-origin policy and could possibly lead to data being leaked to the
wrong domain. (CVE-2011-2362)

All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-2.0.0.24-18.el5_6.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 6b86a71ed48508b8f6f05b4ae53dd355
SHA-256: b04d99b58964f387c708730ad17a08f12769d5717a803192a04d0f0c9d3f01f1
 
IA-32:
thunderbird-2.0.0.24-18.el5_6.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: efc4023b01c22ad8a327bcdb5f4e6f44
SHA-256: d829207087e39d52e05f3c761cd906a0f1cb57b5752aba0c8b02e9ca15a90aaf
 
x86_64:
thunderbird-2.0.0.24-18.el5_6.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 5c989cd261d27b0ac923747ec37ccb0d
SHA-256: 8f3f207523bcf76e5d36a13671b2f31428dfb1b248a0c8e6b7771927f753343c
 
RHEL Optional Productivity Applications EUS (v. 5.6.z server)

SRPMS:
thunderbird-2.0.0.24-18.el5_6.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 6b86a71ed48508b8f6f05b4ae53dd355
SHA-256: b04d99b58964f387c708730ad17a08f12769d5717a803192a04d0f0c9d3f01f1
 
IA-32:
thunderbird-2.0.0.24-18.el5_6.i386.rpm     MD5: efc4023b01c22ad8a327bcdb5f4e6f44
SHA-256: d829207087e39d52e05f3c761cd906a0f1cb57b5752aba0c8b02e9ca15a90aaf
 
x86_64:
thunderbird-2.0.0.24-18.el5_6.x86_64.rpm     MD5: 5c989cd261d27b0ac923747ec37ccb0d
SHA-256: 8f3f207523bcf76e5d36a13671b2f31428dfb1b248a0c8e6b7771927f753343c
 
Red Hat Desktop (v. 4)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
IA-64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: a74898579d965730ba1983bb5475a68c
SHA-256: 3240fb5de2a86b3f3438336c1bf2d0017b0b0cd90d9fb799ca140dc33a871acc
 
PPC:
thunderbird-1.5.0.12-39.el4.ppc.rpm
File outdated by:  RHSA-2012:0085
    MD5: dd08f951447eaed316119b092fbbb096
SHA-256: 1fe43fa9907877986170585fbce57dc46be85b36da532b0a4a84e3bb5faa1ed5
 
s390:
thunderbird-1.5.0.12-39.el4.s390.rpm
File outdated by:  RHSA-2012:0085
    MD5: b3eb13f6f9030966dd395dec8961518c
SHA-256: 107f11ca7d1546822b40560be1abcb03602f04dfc4e0815a32e344bffa3dac5d
 
s390x:
thunderbird-1.5.0.12-39.el4.s390x.rpm
File outdated by:  RHSA-2012:0085
    MD5: 583256d4591e813c683cd49c9b2c6627
SHA-256: ce801de2f96e5e1cecd1af2a11dba1ee03efaa588341c187640871a5d8d479da
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
Red Hat Enterprise Linux AS (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm     MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
IA-64:
thunderbird-1.5.0.12-39.el4.ia64.rpm     MD5: a74898579d965730ba1983bb5475a68c
SHA-256: 3240fb5de2a86b3f3438336c1bf2d0017b0b0cd90d9fb799ca140dc33a871acc
 
PPC:
thunderbird-1.5.0.12-39.el4.ppc.rpm     MD5: dd08f951447eaed316119b092fbbb096
SHA-256: 1fe43fa9907877986170585fbce57dc46be85b36da532b0a4a84e3bb5faa1ed5
 
s390:
thunderbird-1.5.0.12-39.el4.s390.rpm     MD5: b3eb13f6f9030966dd395dec8961518c
SHA-256: 107f11ca7d1546822b40560be1abcb03602f04dfc4e0815a32e344bffa3dac5d
 
s390x:
thunderbird-1.5.0.12-39.el4.s390x.rpm     MD5: 583256d4591e813c683cd49c9b2c6627
SHA-256: ce801de2f96e5e1cecd1af2a11dba1ee03efaa588341c187640871a5d8d479da
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm     MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-2.0.0.24-18.el5_6.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 6b86a71ed48508b8f6f05b4ae53dd355
SHA-256: b04d99b58964f387c708730ad17a08f12769d5717a803192a04d0f0c9d3f01f1
 
IA-32:
thunderbird-2.0.0.24-18.el5_6.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: efc4023b01c22ad8a327bcdb5f4e6f44
SHA-256: d829207087e39d52e05f3c761cd906a0f1cb57b5752aba0c8b02e9ca15a90aaf
 
x86_64:
thunderbird-2.0.0.24-18.el5_6.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 5c989cd261d27b0ac923747ec37ccb0d
SHA-256: 8f3f207523bcf76e5d36a13671b2f31428dfb1b248a0c8e6b7771927f753343c
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
IA-64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: a74898579d965730ba1983bb5475a68c
SHA-256: 3240fb5de2a86b3f3438336c1bf2d0017b0b0cd90d9fb799ca140dc33a871acc
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
Red Hat Enterprise Linux ES (v. 4.8.z)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm     MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
IA-64:
thunderbird-1.5.0.12-39.el4.ia64.rpm     MD5: a74898579d965730ba1983bb5475a68c
SHA-256: 3240fb5de2a86b3f3438336c1bf2d0017b0b0cd90d9fb799ca140dc33a871acc
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm     MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
thunderbird-1.5.0.12-39.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: 900971826302d64898a268e32b41ed53
SHA-256: ed424f63108221c1266cd8a4d62bffbc6d37cc096585af6f09acf5bc017a7c88
 
IA-32:
thunderbird-1.5.0.12-39.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 3ab3cdfbea46a29ff4f49301093585ec
SHA-256: 6b290222ef280ab1c9f9501f26e6918ff1b77580313adcba09b756900a05216a
 
IA-64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: a74898579d965730ba1983bb5475a68c
SHA-256: 3240fb5de2a86b3f3438336c1bf2d0017b0b0cd90d9fb799ca140dc33a871acc
 
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 34d2db28234286ef38b92e90eddcd68d
SHA-256: 2ec45be81297b4a17ec30484bd09912721f7cf41313af301a3fc4a92d207b4d8
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

714576 - CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376 Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
714577 - CVE-2011-2373 Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)
714580 - CVE-2011-2371 Mozilla Integer overflow and arbitrary code execution (MFSA 2011-22)
714581 - CVE-2011-0083 CVE-2011-0085 CVE-2011-2363 Mozilla Multiple dangling pointer vulnerabilities (MFSA 2011-23)
714583 - CVE-2011-2362 Mozilla Cookie isolation error (MFSA 2011-24)
714929 - CVE-2011-2377 Mozilla Crash caused by corrupted JPEG image (MFSA 2011-21)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/