Synopsis

thunderbird security update

Type/Severity

Security Advisory: Important

Topic

Updated thunderbird package that fixes various bugs is now available for
Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

A bug was found in the way Thunderbird handled anonymous functions during
regular expression string replacement. It is possible for a malicious HTML
mail to capture a random block of client memory. The Common
Vulnerabilities and Exposures project has assigned this bug the name
CAN-2005-0989.

A bug was found in the way Thunderbird validated several XPInstall related
JavaScript objects. A malicious HTML mail could pass other objects to the
XPInstall objects, resulting in the JavaScript interpreter jumping to
arbitrary locations in memory. (CAN-2005-1159)

A bug was found in the way the Thunderbird privileged UI code handled DOM
nodes from the content window. An HTML message could install malicious
JavaScript code or steal data when a user performs commonplace actions such
as clicking a link or opening the context menu. (CAN-2005-1160)

A bug was found in the way Thunderbird executed JavaScript code. JavaScript
executed from HTML mail should run with a restricted access level,
preventing dangerous actions. It is possible that a malicious HTML mail
could execute JavaScript code with elevated privileges, allowing access to
protected data and functions. (CAN-2005-1532)

A bug was found in the way Thunderbird executed Javascript in XBL controls.
It is possible for a malicious HTML mail to leverage this vulnerability to
execute other JavaScript based attacks even when JavaScript is disabled.
(CAN-2005-2261)

A bug was found in the way Thunderbird handled certain Javascript
functions. It is possible for a malicious HTML mail to crash the client by
executing malformed Javascript code. (CAN-2005-2265)

A bug was found in the way Thunderbird handled child frames. It is possible
for a malicious framed HTML mail to steal sensitive information from its
parent frame. (CAN-2005-2266)

A bug was found in the way Thunderbird handled DOM node names. It is
possible for a malicious HTML mail to overwrite a DOM node name, allowing
certain privileged chrome actions to execute the malicious JavaScript.
(CAN-2005-2269)

A bug was found in the way Thunderbird cloned base objects. It is possible
for HTML content to navigate up the prototype chain to gain access to
privileged chrome objects. (CAN-2005-2270)

Users of Thunderbird are advised to upgrade to this updated package that
contains Thunderbird version 1.0.6 and is not vulnerable to these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 163285 - CAN-2005-0989 multiple thunderbird issues (CAN-2005-1159 CAN-2005-1160 CAN-2005-1532 CAN-2005-2261 CAN-2005-2265 CAN-2005-2266 CAN-2005-2269 CAN-2005-2270)

CVEs

• CVE-2005-0989
• CVE-2005-1159
• CVE-2005-1160
• CVE-2005-1532
• CVE-2005-2261
• CVE-2005-2265
• CVE-2005-2266
• CVE-2005-2269
• CVE-2005-2270

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
thunderbird-1.0.6-1.4.1.src.rpm	SHA-256: 58f495237c7dfc4fc8bce15721c82355a325dd3ba6320d30db973b6f7cba7c56
x86_64
thunderbird-1.0.6-1.4.1.x86_64.rpm	SHA-256: 5fc4b76e7b3f5470637332e4ab09fd616e096b324f47aba73c5ea8ebb821826f
thunderbird-1.0.6-1.4.1.x86_64.rpm	SHA-256: 5fc4b76e7b3f5470637332e4ab09fd616e096b324f47aba73c5ea8ebb821826f
ia64
thunderbird-1.0.6-1.4.1.ia64.rpm	SHA-256: 687cc3cbd047a7c53845e1197f83d661a9c1456e21c4f05cdda99d83a7821dd7
thunderbird-1.0.6-1.4.1.ia64.rpm	SHA-256: 687cc3cbd047a7c53845e1197f83d661a9c1456e21c4f05cdda99d83a7821dd7
i386
thunderbird-1.0.6-1.4.1.i386.rpm	SHA-256: 99e7302070edfe06bc3f77d1559fe6dd04bf65552cfce15d2748a55c58a88474
thunderbird-1.0.6-1.4.1.i386.rpm	SHA-256: 99e7302070edfe06bc3f77d1559fe6dd04bf65552cfce15d2748a55c58a88474

Red Hat Enterprise Linux Workstation 4

SRPM
thunderbird-1.0.6-1.4.1.src.rpm	SHA-256: 58f495237c7dfc4fc8bce15721c82355a325dd3ba6320d30db973b6f7cba7c56
x86_64
thunderbird-1.0.6-1.4.1.x86_64.rpm	SHA-256: 5fc4b76e7b3f5470637332e4ab09fd616e096b324f47aba73c5ea8ebb821826f
ia64
thunderbird-1.0.6-1.4.1.ia64.rpm	SHA-256: 687cc3cbd047a7c53845e1197f83d661a9c1456e21c4f05cdda99d83a7821dd7
i386
thunderbird-1.0.6-1.4.1.i386.rpm	SHA-256: 99e7302070edfe06bc3f77d1559fe6dd04bf65552cfce15d2748a55c58a88474

Red Hat Enterprise Linux Desktop 4

SRPM
thunderbird-1.0.6-1.4.1.src.rpm	SHA-256: 58f495237c7dfc4fc8bce15721c82355a325dd3ba6320d30db973b6f7cba7c56
x86_64
thunderbird-1.0.6-1.4.1.x86_64.rpm	SHA-256: 5fc4b76e7b3f5470637332e4ab09fd616e096b324f47aba73c5ea8ebb821826f
i386
thunderbird-1.0.6-1.4.1.i386.rpm	SHA-256: 99e7302070edfe06bc3f77d1559fe6dd04bf65552cfce15d2748a55c58a88474

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
thunderbird-1.0.6-1.4.1.src.rpm	SHA-256: 58f495237c7dfc4fc8bce15721c82355a325dd3ba6320d30db973b6f7cba7c56
s390x
thunderbird-1.0.6-1.4.1.s390x.rpm	SHA-256: cbaee5c1b0e547406c347ee63d802a41d9ca6ed59fde11f60778ca7f0513d425
s390
thunderbird-1.0.6-1.4.1.s390.rpm	SHA-256: 697df05e1dee976d901f965bb6ad7a4c128db5c0e1f360093ffd50cc921a86ad

Red Hat Enterprise Linux for Power, big endian 4

SRPM
thunderbird-1.0.6-1.4.1.src.rpm	SHA-256: 58f495237c7dfc4fc8bce15721c82355a325dd3ba6320d30db973b6f7cba7c56
ppc
thunderbird-1.0.6-1.4.1.ppc.rpm	SHA-256: e7e9f53d219c0cebb8b06d908c1e21f61ef33c69030758bdb32133787a203534