Skip to navigation

Security Advisory Important: thunderbird security update

Advisory: RHSA-2013:1823-4
Type: Security Advisory
Severity: Important
Issued on: 2013-12-11
Last updated on: 2013-12-11
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server AUS (v. 6.5)
Red Hat Enterprise Linux Server EUS (v. 6.5.z)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2013-0772
CVE-2013-5609
CVE-2013-5612
CVE-2013-5613
CVE-2013-5614
CVE-2013-5616
CVE-2013-5618
CVE-2013-6671
CVE-2013-6674

Details

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content.
Malicious content could cause Thunderbird to crash or, potentially, execute
arbitrary code with the privileges of the user running Thunderbird.
(CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Thunderbird rendered web content with missing
character encoding information. An attacker could use this flaw to possibly
bypass same-origin inheritance and perform cross site-scripting (XSS)
attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions
applied by sandboxed iframes. An attacker could combine this flaw with
other vulnerabilities to execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2013-5614)

Note: All of the above issues cannot be exploited by a specially crafted
HTML mail message as JavaScript is disabled by default for mail messages.
They could be exploited another way in Thunderbird, for example, when
viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues.
Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian
Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson
Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security
advisories for Thunderbird 24.2.0 ESR. You can find a link to the Mozilla
advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which
contains Thunderbird version 24.2.0 ESR, which corrects these issues.
After installing the update, Thunderbird must be restarted for the changes
to take effect.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-24.2.0-2.el5_10.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 962f4776bf8a31a9a6cca7d455a1c655
SHA-256: 164abcf23d38480dd1e101f5d0969a8cae43724965dc0e15b3ab9e29041183d6
 
IA-32:
thunderbird-24.2.0-2.el5_10.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: ec61e81254ea18e69544a6eda828a971
SHA-256: 2036aacb83f0d9b888f14edcc79603efd8c6150fe520c8595fd3f52fde72637d
thunderbird-debuginfo-24.2.0-2.el5_10.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 86981d0d81176b6026d2538da506154c
SHA-256: 0f49265908b211c85207de0fd54b6fe0368c66de2300c3d3652395ce77bdbcac
 
x86_64:
thunderbird-24.2.0-2.el5_10.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 1d78ec3bd00872633d93db25e57d282b
SHA-256: 9682cb87f4737bf94519931f88ca9ce4eb009e73f5f1b2e88062ec187763ce15
thunderbird-debuginfo-24.2.0-2.el5_10.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: c8524b86a78241b2cb8c34f4232e2c94
SHA-256: 082f3f3677f8fe6b929e96eec83dda4ee1dacc1178ac29332dba1f4429bb2000
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-24.2.0-2.el5_10.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 962f4776bf8a31a9a6cca7d455a1c655
SHA-256: 164abcf23d38480dd1e101f5d0969a8cae43724965dc0e15b3ab9e29041183d6
 
IA-32:
thunderbird-24.2.0-2.el5_10.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: ec61e81254ea18e69544a6eda828a971
SHA-256: 2036aacb83f0d9b888f14edcc79603efd8c6150fe520c8595fd3f52fde72637d
thunderbird-debuginfo-24.2.0-2.el5_10.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 86981d0d81176b6026d2538da506154c
SHA-256: 0f49265908b211c85207de0fd54b6fe0368c66de2300c3d3652395ce77bdbcac
 
x86_64:
thunderbird-24.2.0-2.el5_10.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 1d78ec3bd00872633d93db25e57d282b
SHA-256: 9682cb87f4737bf94519931f88ca9ce4eb009e73f5f1b2e88062ec187763ce15
thunderbird-debuginfo-24.2.0-2.el5_10.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: c8524b86a78241b2cb8c34f4232e2c94
SHA-256: 082f3f3677f8fe6b929e96eec83dda4ee1dacc1178ac29332dba1f4429bb2000
 
Red Hat Enterprise Linux Desktop (v. 6)

SRPMS:
thunderbird-24.2.0-1.el6_5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 3859c36d1296e6893ea778f2e75172a7
SHA-256: d784c1916ce7d3db6204f25a796d1e93ae425382bf1f350e6c38821c0fa4bdec
 
IA-32:
thunderbird-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0265d5219d7151cdb2cf2626184a3442
SHA-256: b5725e49b9406d627580cdb95e2fe7dca1437ddb1e477a4350a31b9a60be351c
thunderbird-debuginfo-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: e7d2f7842556e1644bc3c298aeea6537
SHA-256: a2885097b232353809293b30807f20ac941d0ce4a71d207ea7dc493260c3093e
 
x86_64:
thunderbird-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e1c56ff0ed859298a8c8af1a32dcb14b
SHA-256: 7cb6a8a1593c33cfa94bb9e67062d7c5bc61c824793cc0420296716f319ff2e6
thunderbird-debuginfo-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: f00de842fa7cf4c6252d415ad2232b82
SHA-256: 4460e86a08f2c227f2bef2a8300edd6a408a002e9092fd95db92c1c27b3b60f1
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
thunderbird-24.2.0-1.el6_5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 3859c36d1296e6893ea778f2e75172a7
SHA-256: d784c1916ce7d3db6204f25a796d1e93ae425382bf1f350e6c38821c0fa4bdec
 
IA-32:
thunderbird-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0265d5219d7151cdb2cf2626184a3442
SHA-256: b5725e49b9406d627580cdb95e2fe7dca1437ddb1e477a4350a31b9a60be351c
thunderbird-debuginfo-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: e7d2f7842556e1644bc3c298aeea6537
SHA-256: a2885097b232353809293b30807f20ac941d0ce4a71d207ea7dc493260c3093e
 
PPC:
thunderbird-24.2.0-1.el6_5.ppc64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 9cb73219b0eb41e186fae8f72c7daff9
SHA-256: e0d5315be3d008dc046144e58b0307f851926e6151ecfdd2ffb39046e94e8131
thunderbird-debuginfo-24.2.0-1.el6_5.ppc64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 403926e7f6c0d4b11c5f7c710afa19e4
SHA-256: 2879fb8aef7012066d1e615b71ec8c17ede3f6827cbc2c7bea2c28d94abc1440
 
s390x:
thunderbird-24.2.0-1.el6_5.s390x.rpm
File outdated by:  RHSA-2014:0316
    MD5: cd3e1fffde5f83996ffe45c402f39c4f
SHA-256: 4cb7deefe167fdbef7e8a5a1205c350701374a6d73a76da66b294bef8e060eb4
thunderbird-debuginfo-24.2.0-1.el6_5.s390x.rpm
File outdated by:  RHSA-2014:0316
    MD5: 72092eca9c980531026e323edd798a50
SHA-256: 5ebb58d34ea5778e4605bbd2fae2d4dbbb5143a4b53aa0c96e8d25149fb71309
 
x86_64:
thunderbird-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e1c56ff0ed859298a8c8af1a32dcb14b
SHA-256: 7cb6a8a1593c33cfa94bb9e67062d7c5bc61c824793cc0420296716f319ff2e6
thunderbird-debuginfo-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: f00de842fa7cf4c6252d415ad2232b82
SHA-256: 4460e86a08f2c227f2bef2a8300edd6a408a002e9092fd95db92c1c27b3b60f1
 
Red Hat Enterprise Linux Server AUS (v. 6.5)

SRPMS:
thunderbird-24.2.0-1.el6_5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 3859c36d1296e6893ea778f2e75172a7
SHA-256: d784c1916ce7d3db6204f25a796d1e93ae425382bf1f350e6c38821c0fa4bdec
 
x86_64:
thunderbird-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e1c56ff0ed859298a8c8af1a32dcb14b
SHA-256: 7cb6a8a1593c33cfa94bb9e67062d7c5bc61c824793cc0420296716f319ff2e6
thunderbird-debuginfo-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: f00de842fa7cf4c6252d415ad2232b82
SHA-256: 4460e86a08f2c227f2bef2a8300edd6a408a002e9092fd95db92c1c27b3b60f1
 
Red Hat Enterprise Linux Server EUS (v. 6.5.z)

SRPMS:
thunderbird-24.2.0-1.el6_5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 3859c36d1296e6893ea778f2e75172a7
SHA-256: d784c1916ce7d3db6204f25a796d1e93ae425382bf1f350e6c38821c0fa4bdec
 
IA-32:
thunderbird-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0265d5219d7151cdb2cf2626184a3442
SHA-256: b5725e49b9406d627580cdb95e2fe7dca1437ddb1e477a4350a31b9a60be351c
thunderbird-debuginfo-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: e7d2f7842556e1644bc3c298aeea6537
SHA-256: a2885097b232353809293b30807f20ac941d0ce4a71d207ea7dc493260c3093e
 
PPC:
thunderbird-24.2.0-1.el6_5.ppc64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 9cb73219b0eb41e186fae8f72c7daff9
SHA-256: e0d5315be3d008dc046144e58b0307f851926e6151ecfdd2ffb39046e94e8131
thunderbird-debuginfo-24.2.0-1.el6_5.ppc64.rpm
File outdated by:  RHSA-2014:0316
    MD5: 403926e7f6c0d4b11c5f7c710afa19e4
SHA-256: 2879fb8aef7012066d1e615b71ec8c17ede3f6827cbc2c7bea2c28d94abc1440
 
s390x:
thunderbird-24.2.0-1.el6_5.s390x.rpm
File outdated by:  RHSA-2014:0316
    MD5: cd3e1fffde5f83996ffe45c402f39c4f
SHA-256: 4cb7deefe167fdbef7e8a5a1205c350701374a6d73a76da66b294bef8e060eb4
thunderbird-debuginfo-24.2.0-1.el6_5.s390x.rpm
File outdated by:  RHSA-2014:0316
    MD5: 72092eca9c980531026e323edd798a50
SHA-256: 5ebb58d34ea5778e4605bbd2fae2d4dbbb5143a4b53aa0c96e8d25149fb71309
 
x86_64:
thunderbird-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e1c56ff0ed859298a8c8af1a32dcb14b
SHA-256: 7cb6a8a1593c33cfa94bb9e67062d7c5bc61c824793cc0420296716f319ff2e6
thunderbird-debuginfo-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: f00de842fa7cf4c6252d415ad2232b82
SHA-256: 4460e86a08f2c227f2bef2a8300edd6a408a002e9092fd95db92c1c27b3b60f1
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
thunderbird-24.2.0-1.el6_5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: 3859c36d1296e6893ea778f2e75172a7
SHA-256: d784c1916ce7d3db6204f25a796d1e93ae425382bf1f350e6c38821c0fa4bdec
 
IA-32:
thunderbird-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: 0265d5219d7151cdb2cf2626184a3442
SHA-256: b5725e49b9406d627580cdb95e2fe7dca1437ddb1e477a4350a31b9a60be351c
thunderbird-debuginfo-24.2.0-1.el6_5.i686.rpm
File outdated by:  RHSA-2014:0316
    MD5: e7d2f7842556e1644bc3c298aeea6537
SHA-256: a2885097b232353809293b30807f20ac941d0ce4a71d207ea7dc493260c3093e
 
x86_64:
thunderbird-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e1c56ff0ed859298a8c8af1a32dcb14b
SHA-256: 7cb6a8a1593c33cfa94bb9e67062d7c5bc61c824793cc0420296716f319ff2e6
thunderbird-debuginfo-24.2.0-1.el6_5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: f00de842fa7cf4c6252d415ad2232b82
SHA-256: 4460e86a08f2c227f2bef2a8300edd6a408a002e9092fd95db92c1c27b3b60f1
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1039417 - CVE-2013-5609 Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104)
1039420 - CVE-2013-5612 Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106)
1039421 - CVE-2013-5614 Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107)
1039422 - CVE-2013-5616 Mozilla: Use-after-free in event listeners (MFSA 2013-108)
1039423 - CVE-2013-5618 Mozilla: Use-after-free during Table Editing (MFSA 2013-109)
1039426 - CVE-2013-6671 Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111)
1039429 - CVE-2013-5613 Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/