Red Hat Security AdvisoryRHSA-2008:0908
thunderbird security update
Released 2008-10-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-16.el4, thunderbird-1.5.0.12-16.el4.i386, thunderbird-1.5.0.12-16.el4.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-2.0.0.17-1.el5, thunderbird-2.0.0.17-1.el5.i386
- Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-16.el4, thunderbird-1.5.0.12-16.el4.i386
- Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-16.el4, thunderbird-1.5.0.12-16.el4.i386, thunderbird-1.5.0.12-16.el4.ia64
- Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-2.0.0.17-1.el5, thunderbird-2.0.0.17-1.el5.i386
- Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-16.el4, thunderbird-1.5.0.12-16.el4.i386, thunderbird-1.5.0.12-16.el4.ia64
Fixes 12 records
Priority HIGH 72
Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.43921 · Published 2008-09-24 · Fixed CWE-119
Priority MEDIUM 53
Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.07351 · Published 2008-09-27 · Fixed CWE-119
Priority MEDIUM 51
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruptio…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04988 · Published 2008-09-24 · Fixed CWE-399
Priority MEDIUM 51
Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corr…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04988 · Published 2008-09-24 · Fixed CWE-189
Priority MEDIUM 41
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML fi…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.04166 · Published 2008-09-24 · Fixed CWE-22
Priority MEDIUM 41
Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04802 · Published 2008-09-24 · Fixed CWE-264
Priority MEDIUM 41
The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04996 · Published 2008-09-24 · Fixed CWE-264
Priority MEDIUM 41
The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05077 · Published 2008-09-24 · Fixed CWE-264
Priority LOW 37
The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary Ja…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02143 · Published 2008-09-24 · Fixed CWE-264
Priority LOW 27
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a ..
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04438 · Published 2008-09-24 · Fixed CWE-22
Priority LOW 27
Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0411 · Published 2008-09-24 · Fixed CWE-79
Priority LOW 24
Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01761 · Published 2008-09-24 · Fixed CWE-79