USN-1369-1 : thunderbird vulnerabilities

NASLDB: USN-1369-1 : thunderbird vulnerabilities

General

ID: 58037
Name: USN-1369-1 : thunderbird vulnerabilities

Summary: Checks dpkg output for updated package(s)

Credits: –

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: –

Port: 0
Family: Ubuntu Local Security Checks
Type: Local

Description

Nicolas Gregoire and Aki Helin discovered that when processing a
malformed embedded XSLT stylesheet, Thunderbird can crash due to
memory corruption. If the user were tricked into opening a specially
crafted page, an attacker could exploit this to cause a denial of
service via application crash, or potentially execute code with the
privileges of the user invoking Thunderbird. (CVE-2012-0449)

It was discovered that memory corruption could occur during the
decoding of Ogg Vorbis files. If the user were tricked into opening a
specially crafted file, an attacker could exploit this to cause a
denial of service via application crash, or potentially execute code
with the privileges of the user invoking Thunderbird. (CVE-2012-0444)

Tim Abraldes discovered that when encoding certain image types the
resulting data was always a fixed size. There is the possibility of
sensitive data from uninitialized memory being appended to these
images. (CVE-2012-0447)

It was discovered that Thunderbird did not properly perform XPConnect
security checks. An attacker could exploit this to conduct cross-site
scripting (XSS) attacks through web pages and Thunderbird extensions.
With cross-site scripting vulnerabilities, if a user were tricked
into viewing a specially crafted page, a remote attacker could
exploit this to modify the contents, or steal confidential data,
within the same domain. (CVE-2012-0446)

It was discovered that Thunderbird did not properly handle node
removal in the DOM. If the user were tricked into opening a specially
crafted page, an attacker could exploit this to cause a denial of
service via application crash, or potentially execute code with the
privileges of the user invoking Thunderbird. (CVE-2011-3659)

Alex Dvorov discovered that Thunderbird did not properly handle
sub-frames in form submissions. An attacker could exploit this to
conduct phishing attacks using HTML5 frames. (CVE-2012-0445)

Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse
Ruderman, Jan Odvarko, Peter Van Der Beken, Bob Clary, and Bill
McCloskey discovered memory safety issues affecting Thunderbird. If
the user were tricked into opening a specially crafted page, an
attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of
the user invoking Thunderbird. (CVE-2012-0442, CVE-2012-0443)

Andrew McCreight and Olli Pettay discovered a use-after-free
vulnerability in the XBL bindings. An attacker could exploit this to
cause a denial of service via application crash, or potentially
execute code with the privileges of the user invoking Thunderbird.
(CVE-2012-0452)

Jueri Aedla discovered that libpng, which is in Thunderbird, did not
properly verify the size used when allocating memory during chunk
decompression. If a user or automated system using libpng were
tricked into opening a specially crafted image, an attacker could
exploit this to cause a denial of service or execute code with the
privileges of the user invoking the program. (CVE-2011-3026)