Red Hat Security Advisory

RHSA-2006:0330

thunderbird security update

Released 2006-04-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.0.8-1.4.1, thunderbird-1.0.8-1.4.1.i386, thunderbird-1.0.8-1.4.1.ia64 +1
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.0.8-1.4.1, thunderbird-1.0.8-1.4.1.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.0.8-1.4.1, thunderbird-1.0.8-1.4.1.i386, thunderbird-1.0.8-1.4.1.ia64
Red Hat Enterprise Linux WS version 4 thunderbird-1.0.8-1.4.1, thunderbird-1.0.8-1.4.1.i386, thunderbird-1.0.8-1.4.1.ia64

Fixes 21 records

TI-2006-01676 CVE-2006-1730 · GHSA-w48v-q8fw-236r

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before…

MEDIUM 53

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.1034 Published 2006-04-14 Fixed CWE-189

TI-2006-00727 CVE-2006-0749 · GHSA-pwcc-x4h8-g74h

nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

MEDIUM 53

nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.10487 Published 2006-04-14 Fixed CWE-399

TI-2006-01681 CVE-2006-1735 · GHSA-r677-35c3-7hmg

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 52

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XB…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09187 Published 2006-04-14 Fixed CWE-264

TI-2006-01674 CVE-2006-1728 · GHSA-27mx-p3cq-xm25

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x…

MEDIUM 52

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknow…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09488 Published 2006-04-14 Fixed

TI-2006-01736 CVE-2006-1790 · GHSA-h8w2-9pxp-qpcc

A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of…

MEDIUM 51

A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05152 Published 2006-04-14 Fixed CWE-399

TI-2006-01685 CVE-2006-1739 · GHSA-wp5w-vcq2-q2gv

The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

MEDIUM 51

The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) a…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08443 Published 2006-04-14 Fixed CWE-119

TI-2006-00726 CVE-2006-0748 · GHSA-hhhq-8f65-6q7x

Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 51

Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical orderi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07968 Published 2006-04-14 Fixed CWE-399

TI-2006-00861 CVE-2006-0884 · GHSA-f48c-g7r5-vhv8

The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and…

MEDIUM 50

The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07232 Published 2006-02-24 Fixed CWE-20

TI-2006-01683 CVE-2006-1737 · GHSA-rxwh-g7jh-p598

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

MEDIUM 48

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly e…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04914 Published 2006-04-14 Fixed CWE-189

TI-2006-01673 CVE-2006-1727 · GHSA-rmjx-gf38-h2g4

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x…

MEDIUM 43

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.06371 Published 2006-04-14 Fixed

TI-2006-01670 CVE-2006-1724 · GHSA-8v22-vg6j-pf23

Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8…

MEDIUM 43

Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly e…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0689 Published 2006-04-14 Fixed

TI-2006-01680 CVE-2006-1734 · GHSA-pc38-w37f-288f

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 40

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.06986 Published 2006-04-14 Fixed

TI-2006-00282 CVE-2006-0292 · GHSA-9fqv-4m7q-x5j2

The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not…

MEDIUM 40

The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04577 Published 2006-02-02 Fixed

TI-2006-01679 CVE-2006-1733 · GHSA-qc6m-vfp3-h4f4

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

LOW 38

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allo…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05196 Published 2006-04-14 Fixed CWE-264

TI-2006-01688 CVE-2006-1742 · GHSA-7mq9-p447-2gr2

The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

LOW 30

The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage coll…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03969 Published 2006-04-14 Fixed

TI-2006-01684 CVE-2006-1738 · GHSA-wgp2-rffm-276c

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

LOW 30

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by ch…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0448 Published 2006-04-14 Fixed

TI-2006-00286 CVE-2006-0296 · GHSA-c65v-php3-gmxx

The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before…

LOW 30

The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04136 Published 2006-02-02 Fixed

TI-2006-01687 CVE-2006-1741 · GHSA-8r79-mxmm-hhc6

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and…

LOW 27

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03892 Published 2006-04-14 Fixed CWE-79

TI-2006-01678 CVE-2006-1732 · GHSA-q8q4-prmv-qrjp

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

LOW 25

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02963 Published 2006-04-14 Fixed

TI-2006-01677 CVE-2006-1731 · GHSA-5g37-6qw5-9qqj

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

LOW 24

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call o…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01822 Published 2006-04-14 Fixed CWE-79

TI-2006-01015 CVE-2006-1045 · GHSA-6m5g-mwm7-wq36

The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote…

LOW 21

The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote atta…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.04974 Published 2006-03-07 Fixed