Advisories ยป MGASA-2013-0326

Updated thunderbird package fixes security vulnerabilities

Publication date: 18 Nov 2013
Modification date: 18 Nov 2013
Type: security
Affected Mageia releases : 2 , 3
CVE: CVE-2013-5590 , CVE-2013-5597 , CVE-2013-5599 , CVE-2013-5600 , CVE-2013-5601 , CVE-2013-5602 , CVE-2013-5595 , CVE-2013-5604

Description

Several flaws were found in the processing of malformed content. Malicious
content could cause Thunderbird to crash or, potentially, execute
arbitrary code with the privileges of the user running Thunderbird
(CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600,
CVE-2013-5601, CVE-2013-5602).

It was found that the Thunderbird JavaScript engine incorrectly allocated
memory for certain functions. An attacker could combine this flaw with
other vulnerabilities to execute arbitrary code with the privileges of the
user running Thunderbird (CVE-2013-5595).

A flaw was found in the way Thunderbird handled certain Extensible
Stylesheet Language Transformations (XSLT) files. An attacker could
combine this flaw with other vulnerabilities to execute arbitrary code
with the privileges of the user running Thunderbird (CVE-2013-5604).

Also, the thunderbird-lightning extension has been updated to a version that
is compatible with the updated Thunderbird.

References

SRPMS

3/core

2/core