Improper Access Control

2019-05-0205:20:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-7201, CVE-2015-7205, CVE-2015-7212, CVE-2015-7213) A flaw was found in the way Thunderbird handled content using the ‘data:’ and ‘view-source:’ URIs. An attacker could use this flaw to bypass the same-origin policy and read data from cross-site URLs and local files. (CVE-2015-7214) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andrei Vaida, Jesse Ruderman, Bob Clary, Abhishek Arya, Ronald Crane, and Tsubasa Iinuma as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 38.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 38.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.

CPENameOperatorVersion
thunderbirdeq17.0.3__2.el5_9
thunderbirdeq31.5.0__1.el6_6
thunderbirdeq10.0.8__1.el6_3
thunderbirdeq24.4.0__1.el6_5
thunderbirdeq1.5.0.10__1.el5
thunderbirdeq17.0.10__1.el6_4
thunderbirdeq2.0.0.16__1.el5
thunderbirdeq2.0.0.24__27.el5_7
thunderbirdeq3.1.10__1.el6_0
thunderbirdeq1.5.0.12__9.el5_1

Name	Operator	Version
thunderbird	eq	17.0.3__2.el5_9
thunderbird	eq	31.5.0__1.el6_6
thunderbird	eq	10.0.8__1.el6_3
thunderbird	eq	24.4.0__1.el6_5
thunderbird	eq	1.5.0.10__1.el5
thunderbird	eq	17.0.10__1.el6_4
thunderbird	eq	2.0.0.16__1.el5
thunderbird	eq	2.0.0.24__27.el5_7
thunderbird	eq	3.1.10__1.el6_0
thunderbird	eq	1.5.0.12__9.el5_1