thunderbird: multiple issues

2016-04-23T00:00:00
ID ASA-201604-12
Type archlinux
Reporter Arch Linux
Modified 2016-04-23T00:00:00

Description

  • CVE-2016-1955 (same-origin policy bypass)

A vulnerability allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.

  • CVE-2016-1956 (denial of service)

Security researcher Ucha Gobejishvili reported a denial of service (DOS) attack when doing certain WebGL operations in a canvas requiring an unusually large amount buffer to be allocated from video memory. This resulted memory resource exhaustion with some Intel video cards, requiring the computer to be rebooted to return functionality. This was resolved by putting in additional checks on the amount of memory to be allocated during graphics processing.