Synopsis

Critical: thunderbird security update

Type/Severity

Security Advisory: Critical

Topic

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content. Malicious
content could cause Thunderbird to crash or, potentially, execute arbitrary
code with the privileges of the user running Thunderbird. (CVE-2013-0775,
CVE-2013-0780, CVE-2013-0782, CVE-2013-0783)

It was found that, after canceling a proxy server's authentication
prompt, the address bar continued to show the requested site's address. An
attacker could use this flaw to conduct phishing attacks by tricking a
user into believing they are viewing trusted content. (CVE-2013-0776)

Red Hat would like to thank the Mozilla project for reporting these issues.
Upstream acknowledges Nils, Abhishek Arya, Olli Pettay, Christoph Diehl,
Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, Wayne Mery, and
Michal Zalewski as the original reporters of these issues.

Note: All issues cannot be exploited by a specially-crafted HTML mail
message as JavaScript is disabled by default for mail messages. They could
be exploited another way in Thunderbird, for example, when viewing the full
remote content of an RSS feed.

Important: This erratum upgrades Thunderbird to version 17.0.3 ESR.
Thunderbird 17 is not completely backwards-compatible with all Mozilla
add-ons and Thunderbird plug-ins that worked with Thunderbird 10.0.
Thunderbird 17 checks compatibility on first-launch, and, depending on the
individual configuration and the installed add-ons and plug-ins, may
disable said Add-ons and plug-ins, or attempt to check for updates and
upgrade them. Add-ons and plug-ins may have to be manually updated.

All Thunderbird users should upgrade to this updated package, which
contains Thunderbird version 17.0.3 ESR, which corrects these issues. After
installing the update, Thunderbird must be restarted for the changes to
take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 6.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 6.3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.9 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.9 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.3 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.3 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.9 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.9 i386

Fixes

• BZ - 911836 - CVE-2013-0783 Mozilla: Miscellaneous memory safety hazards (rv:17.0.3) (MFSA 2013-21)
• BZ - 911843 - CVE-2013-0775 Mozilla: Use-after-free in nsImageLoadingContent (MFSA 2013-26)
• BZ - 911844 - CVE-2013-0776 Mozilla: Phishing on HTTPS connection through malicious proxy (MFSA 2013-27)
• BZ - 911865 - CVE-2013-0780 CVE-2013-0782 Mozilla: Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer (MFSA 2013-28)

CVEs

• CVE-2013-0782
• CVE-2013-0783
• CVE-2013-0780
• CVE-2013-0776
• CVE-2013-0775

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
x86_64
thunderbird-17.0.3-1.el6_3.x86_64.rpm	SHA-256: c755c6feb4db5fca41572b1f8bd947e0f3865aeba7bd11d8c3238684c2690893
thunderbird-debuginfo-17.0.3-1.el6_3.x86_64.rpm	SHA-256: e61c634194279f6fed6bc4a2274e66ca1b91823f821ec4fcf4006b9cc6e2d330
i386
thunderbird-17.0.3-1.el6_3.i686.rpm	SHA-256: 6dd3d0968fab8ed9276ad1a59068be78c4c361df09fd8f4e2bbe1d532096dd0c
thunderbird-debuginfo-17.0.3-1.el6_3.i686.rpm	SHA-256: e392053bc3bf59f1b25834804121027efb3e82f9ad3ccd609363da081da591ac

Red Hat Enterprise Linux Server 5

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53

Red Hat Enterprise Linux Server - Extended Update Support 6.3

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
x86_64
thunderbird-17.0.3-1.el6_3.x86_64.rpm	SHA-256: c755c6feb4db5fca41572b1f8bd947e0f3865aeba7bd11d8c3238684c2690893
thunderbird-debuginfo-17.0.3-1.el6_3.x86_64.rpm	SHA-256: e61c634194279f6fed6bc4a2274e66ca1b91823f821ec4fcf4006b9cc6e2d330
i386
thunderbird-17.0.3-1.el6_3.i686.rpm	SHA-256: 6dd3d0968fab8ed9276ad1a59068be78c4c361df09fd8f4e2bbe1d532096dd0c
thunderbird-debuginfo-17.0.3-1.el6_3.i686.rpm	SHA-256: e392053bc3bf59f1b25834804121027efb3e82f9ad3ccd609363da081da591ac

Red Hat Enterprise Linux Server - Extended Update Support 5.9

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53

Red Hat Enterprise Linux Workstation 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
x86_64
thunderbird-17.0.3-1.el6_3.x86_64.rpm	SHA-256: c755c6feb4db5fca41572b1f8bd947e0f3865aeba7bd11d8c3238684c2690893
thunderbird-debuginfo-17.0.3-1.el6_3.x86_64.rpm	SHA-256: e61c634194279f6fed6bc4a2274e66ca1b91823f821ec4fcf4006b9cc6e2d330
i386
thunderbird-17.0.3-1.el6_3.i686.rpm	SHA-256: 6dd3d0968fab8ed9276ad1a59068be78c4c361df09fd8f4e2bbe1d532096dd0c
thunderbird-debuginfo-17.0.3-1.el6_3.i686.rpm	SHA-256: e392053bc3bf59f1b25834804121027efb3e82f9ad3ccd609363da081da591ac

Red Hat Enterprise Linux Workstation 5

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53

Red Hat Enterprise Linux Desktop 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
x86_64
thunderbird-17.0.3-1.el6_3.x86_64.rpm	SHA-256: c755c6feb4db5fca41572b1f8bd947e0f3865aeba7bd11d8c3238684c2690893
thunderbird-debuginfo-17.0.3-1.el6_3.x86_64.rpm	SHA-256: e61c634194279f6fed6bc4a2274e66ca1b91823f821ec4fcf4006b9cc6e2d330
i386
thunderbird-17.0.3-1.el6_3.i686.rpm	SHA-256: 6dd3d0968fab8ed9276ad1a59068be78c4c361df09fd8f4e2bbe1d532096dd0c
thunderbird-debuginfo-17.0.3-1.el6_3.i686.rpm	SHA-256: e392053bc3bf59f1b25834804121027efb3e82f9ad3ccd609363da081da591ac

Red Hat Enterprise Linux Desktop 5

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
s390x
thunderbird-17.0.3-1.el6_3.s390x.rpm	SHA-256: ea6a12817bf339bbfc25685e95bf70245fe2f5e1bbfa3790fe52833e06323aed
thunderbird-debuginfo-17.0.3-1.el6_3.s390x.rpm	SHA-256: f2a8762e3aeb4d9712adbf0e7f4396436db5431dda9915a498ee63f5f65b28fe

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.3

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
s390x
thunderbird-17.0.3-1.el6_3.s390x.rpm	SHA-256: ea6a12817bf339bbfc25685e95bf70245fe2f5e1bbfa3790fe52833e06323aed
thunderbird-debuginfo-17.0.3-1.el6_3.s390x.rpm	SHA-256: f2a8762e3aeb4d9712adbf0e7f4396436db5431dda9915a498ee63f5f65b28fe

Red Hat Enterprise Linux for Power, big endian 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
ppc64
thunderbird-17.0.3-1.el6_3.ppc64.rpm	SHA-256: 48666ab300b8b1b9c5197a4cb67561d36262c9df3b8d50897c4801dc437db4a2
thunderbird-debuginfo-17.0.3-1.el6_3.ppc64.rpm	SHA-256: 32e31d32c103ffb555f5400b2ca886844890a1a8bf1c267187b627bf37696463

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.3

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
ppc64
thunderbird-17.0.3-1.el6_3.ppc64.rpm	SHA-256: 48666ab300b8b1b9c5197a4cb67561d36262c9df3b8d50897c4801dc437db4a2
thunderbird-debuginfo-17.0.3-1.el6_3.ppc64.rpm	SHA-256: 32e31d32c103ffb555f5400b2ca886844890a1a8bf1c267187b627bf37696463

Red Hat Enterprise Linux Server from RHUI 6

SRPM
thunderbird-17.0.3-1.el6_3.src.rpm	SHA-256: d26da405c3cac5280c9e0cc18852673cb9dca75e87f51edc46187b027b35912e
x86_64
thunderbird-17.0.3-1.el6_3.x86_64.rpm	SHA-256: c755c6feb4db5fca41572b1f8bd947e0f3865aeba7bd11d8c3238684c2690893
thunderbird-debuginfo-17.0.3-1.el6_3.x86_64.rpm	SHA-256: e61c634194279f6fed6bc4a2274e66ca1b91823f821ec4fcf4006b9cc6e2d330
i386
thunderbird-17.0.3-1.el6_3.i686.rpm	SHA-256: 6dd3d0968fab8ed9276ad1a59068be78c4c361df09fd8f4e2bbe1d532096dd0c
thunderbird-debuginfo-17.0.3-1.el6_3.i686.rpm	SHA-256: e392053bc3bf59f1b25834804121027efb3e82f9ad3ccd609363da081da591ac

Red Hat Enterprise Linux Server from RHUI 5

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.9

SRPM
thunderbird-17.0.3-1.el5_9.src.rpm	SHA-256: f9df3dab9a87e7db4e026a5d136d83ea667999f97d89f333daa897e719848c4c
x86_64
thunderbird-17.0.3-1.el5_9.x86_64.rpm	SHA-256: 12fbecdb01943ec39e9a6f129a9c5a71e920c81f97c400421893be5d0d76450a
thunderbird-debuginfo-17.0.3-1.el5_9.x86_64.rpm	SHA-256: dd3c23656be2fccbdc4906a712e03d7062b30f826085d5cad6ddfe6c1046017d
i386
thunderbird-17.0.3-1.el5_9.i386.rpm	SHA-256: 29a7b534b9d861913d3cfa7e3e66a899baaeb9c011015945a869e01ef864580e
thunderbird-debuginfo-17.0.3-1.el5_9.i386.rpm	SHA-256: 661140a0098cc310927570f7e72223853a5d036b67744049a8ab762eab754c53