Executive Summary
Summary | |
---|---|
Title | Thunderbird vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-2819-1 | First vendor Publication | 2015-12-01 |
Vendor | Ubuntu | Last vendor Modification | 2015-12-01 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Thunderbird. Software Description: - thunderbird: Mozilla Open Source mail and newsgroup client Details: Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-4513) Tyson Smith and David Keeler discovered a use-after-poison and buffer overflow in NSS. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7181, CVE-2015-7182) Ryan Sleevi discovered an integer overflow in NSPR. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7183) MichaÅ Bentkowski discovered that adding white-space to hostnames that are IP addresses can bypass same-origin protections. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2015-7188) Looben Yang discovered a buffer overflow during script interactions with the canvas element in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7189) Shinto K Anto discovered that CORS preflight is bypassed when receiving non-standard Content-Type headers in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2015-7193) Gustavo Grieco discovered a buffer overflow in libjar in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7194) Ehsan Akhgari discovered a mechanism for a web worker to bypass secure requirements for web sockets. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could exploit this to bypass the mixed content web socket policy. (CVE-2015-7197) Ronald Crane discovered several vulnerabilities through code-inspection. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7198, CVE-2015-7199, CVE-2015-7200) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: Ubuntu 15.04: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: After a standard system update you need to restart Thunderbird to make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-2819-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
57 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
14 % | CWE-254 | Security Features |
7 % | CWE-362 | Race Condition |
7 % | CWE-264 | Permissions, Privileges, and Access Controls |
7 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
7 % | CWE-17 | Code |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-10-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3688.nasl - Type : ACT_GATHER_INFO |
2016-06-22 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0066.nasl - Type : ACT_GATHER_INFO |
2016-06-22 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0065.nasl - Type : ACT_GATHER_INFO |
2016-05-31 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201605-06.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote Debian host is missing a security update. File : debian_DLA-480.nasl - Type : ACT_GATHER_INFO |
2016-04-22 | Name : The remote web server is affected by a remote code execution vulnerability. File : glassfish_cpu_apr_2016.nasl - Type : ACT_GATHER_INFO |
2016-04-21 | Name : The remote web server is affected by a remote code execution vulnerability. File : sun_java_web_server_7_0_23.nasl - Type : ACT_GATHER_INFO |
2016-04-21 | Name : The remote web proxy server is affected by a remote code execution vulnerabil... File : iplanet_web_proxy_4_0_27.nasl - Type : ACT_GATHER_INFO |
2016-02-19 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL31372672.nasl - Type : ACT_GATHER_INFO |
2016-01-21 | Name : An application installed on the remote host is affected by multiple vulnerabi... File : virtualbox_5_0_10.nasl - Type : ACT_GATHER_INFO |
2016-01-04 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201512-10.nasl - Type : ACT_GATHER_INFO |
2015-12-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-885.nasl - Type : ACT_GATHER_INFO |
2015-12-16 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-877.nasl - Type : ACT_GATHER_INFO |
2015-12-02 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2819-1.nasl - Type : ACT_GATHER_INFO |
2015-12-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3410.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151126_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2519.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2015-2519.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_38_4.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Mac OS X host contains a mail client that is affected by multiple ... File : macosx_thunderbird_38_4.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3406.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Debian host is missing a security update. File : debian_DLA-354.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2015-2519.nasl - Type : ACT_GATHER_INFO |
2015-11-25 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-2081-1.nasl - Type : ACT_GATHER_INFO |
2015-11-20 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_9d04936c75f14a2c9ade4c1708be5df9.nasl - Type : ACT_GATHER_INFO |
2015-11-20 | Name : The remote Debian host is missing a security update. File : debian_DLA-344.nasl - Type : ACT_GATHER_INFO |
2015-11-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2068.nasl - Type : ACT_GATHER_INFO |
2015-11-13 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1981-1.nasl - Type : ACT_GATHER_INFO |
2015-11-13 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1978-1.nasl - Type : ACT_GATHER_INFO |
2015-11-10 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1926-1.nasl - Type : ACT_GATHER_INFO |
2015-11-10 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-718.nasl - Type : ACT_GATHER_INFO |
2015-11-09 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2015-310-02.nasl - Type : ACT_GATHER_INFO |
2015-11-06 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2015-0145.nasl - Type : ACT_GATHER_INFO |
2015-11-06 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-608.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-1981.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-1980.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-1980.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_42.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_38_4_esr.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_42.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_38_4_esr.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3393.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2015-1982.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-1981.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2015-1982.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-1981.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-1982.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151104_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151104_nss__nss_util__and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151104_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2785-1.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2790-1.nasl - Type : ACT_GATHER_INFO |
2015-11-05 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2791-1.nasl - Type : ACT_GATHER_INFO |
2015-11-04 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-1980.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-01-22 09:27:01 |
|
2015-12-03 13:26:56 |
|
2015-12-01 17:23:01 |
|