Lucene search

K
ubuntuUbuntuUSN-3141-1
HistoryDec 01, 2016 - 12:00 a.m.

Thunderbird vulnerabilities

2016-12-0100:00:00
ubuntu.com
56

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.952 High

EPSS

Percentile

99.3%

Releases

  • Ubuntu 16.10
  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM
  • Ubuntu 12.04

Packages

  • thunderbird - Mozilla Open Source mail and newsgroup client

Details

Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong,
Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues
in Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5290)

A same-origin policy bypass was discovered with local HTML files in some
circumstances. An attacker could potentially exploit this to obtain
sensitive information. (CVE-2016-5291)

A heap buffer-overflow was discovered in Cairo when processing SVG
content. If a user were tricked in to opening a specially crafted message,
an attacker could potentially exploit this to cause a denial of service
via application crash, or execute arbitrary code. (CVE-2016-5296)

An error was discovered in argument length checking in Javascript. If a
user were tricked in to opening a specially crafted website in a browsing
context, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5297)

A buffer overflow was discovered in nsScriptLoadHandler. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit this to cause a denial of service
via application crash, or execute arbitrary code. (CVE-2016-9066)

A use-after-free was discovered in SVG animations. If a user were tricked
in to opening a specially crafted website in a browsing context, an
attacker could exploit this to cause a denial of service via application
crash, or execute arbitrary code. (CVE-2016-9079)

OSVersionArchitecturePackageVersionFilename
Ubuntu16.10noarchthunderbird< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-dbg< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-dbgsym< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-dev< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-dev-dbgsym< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-globalmenu< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-gnome-support< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-gnome-support-dbg< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-locale-af< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Ubuntu16.10noarchthunderbird-locale-ar< 1:45.5.1+build1-0ubuntu0.16.10.1UNKNOWN
Rows per page:
1-10 of 3201

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.952 High

EPSS

Percentile

99.3%