Red Hat Security Advisory

RHSA-2008:0105

thunderbird security update

Released 2008-02-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-8.el4, thunderbird-1.5.0.12-8.el4.i386, thunderbird-1.5.0.12-8.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-1.5.0.12-8.el5, thunderbird-1.5.0.12-8.el5.i386
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-8.el4, thunderbird-1.5.0.12-8.el4.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-8.el4, thunderbird-1.5.0.12-8.el4.i386, thunderbird-1.5.0.12-8.el4.ia64
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-1.5.0.12-8.el5, thunderbird-1.5.0.12-8.el5.i386
Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-8.el4, thunderbird-1.5.0.12-8.el4.i386, thunderbird-1.5.0.12-8.el4.ia64

Fixes 10 records

TI-2008-00394 CVE-2008-0419 · GHSA-qh9w-47rq-86x3

Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to…

MEDIUM 47

Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to steal navigation history and cause a denial of service (crash) via images in a page that uses designMode frames, which triggers memory…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03796 Published 2008-02-08 Fixed CWE-399

TI-2008-00387 CVE-2008-0412 · GHSA-cj4c-5gff-3x9p

The browser engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and…

MEDIUM 46

The browser engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vecto…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03304 Published 2008-02-08 Fixed CWE-399

TI-2008-00388 CVE-2008-0413 · GHSA-mx7q-m4p3-672f

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12…

MEDIUM 45

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.02484 Published 2008-02-08 Fixed CWE-399

TI-2008-00395 CVE-2008-0420 · GHSA-6cgj-54pv-ggm2

modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12…

MEDIUM 44

modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.02224 Published 2008-02-12 Fixed CWE-200

TI-2008-00286 CVE-2008-0304 · GHSA-3j5j-x7ph-c2r8

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before…

MEDIUM 42

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message, related to a…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.06049 Published 2008-02-29 Fixed CWE-119

TI-2008-00393 CVE-2008-0418 · GHSA-2rxc-55rq-5r4c

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before…

LOW 31

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and st…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08633 Published 2008-02-08 Fixed CWE-22

TI-2008-00563 CVE-2008-0591 · GHSA-grpg-6mx5-wwhv

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage…

LOW 27

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, suc…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03849 Published 2008-02-08 Fixed

TI-2008-00565 CVE-2008-0593 · GHSA-x927-rph6-c38j

Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before…

LOW 24

Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypa…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02037 Published 2008-02-09 Fixed CWE-200

TI-2008-00564 CVE-2008-0592 · GHSA-pr6g-954v-x2pf

Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote…

LOW 24

Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to cause a denial of service via a plain .txt file with a "Content-Disposition: attachment" and an invalid "Content-Type: p…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01785 Published 2008-02-08 Fixed

TI-2008-00390 CVE-2008-0415 · GHSA-gchv-r656-x69r

Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8…

LOW 24

Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vector…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02205 Published 2008-02-08 Fixed CWE-79