Red Hat Security Advisory

RHSA-2008:0976

thunderbird security update

Released 2008-11-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-17.el4, thunderbird-1.5.0.12-17.el4.i386, thunderbird-1.5.0.12-17.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-2.0.0.18-1.el5, thunderbird-2.0.0.18-1.el5.i386
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-17.el4, thunderbird-1.5.0.12-17.el4.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-17.el4, thunderbird-1.5.0.12-17.el4.i386, thunderbird-1.5.0.12-17.el4.ia64
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-2.0.0.18-1.el5, thunderbird-2.0.0.18-1.el5.i386
Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-17.el4, thunderbird-1.5.0.12-17.el4.i386, thunderbird-1.5.0.12-17.el4.ia64

Fixes 9 records

TI-2008-04768 CVE-2008-5014 · GHSA-8m88-6wvj-46c6

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird…

MEDIUM 52

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly exec…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05865 Published 2008-11-13 Fixed CWE-20

TI-2008-04805 CVE-2008-5052 · GHSA-4fmr-pw88-x9j3

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before…

MEDIUM 49

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (cr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03448 Published 2008-11-13 Fixed CWE-399

TI-2008-04772 CVE-2008-5018 · GHSA-ww2m-xjhr-w96h

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18…

MEDIUM 49

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via ve…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-399

TI-2008-04771 CVE-2008-5017 · GHSA-h983-53hw-mp7w

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x…

MEDIUM 49

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers t…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-189

TI-2008-04774 CVE-2008-5021 · GHSA-7qf3-8pfp-6qg9

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x…

MEDIUM 46

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03633 Published 2008-11-13 Fixed CWE-362

TI-2008-04777 CVE-2008-5024 · GHSA-r9x5-wf23-5hh7

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before…

LOW 39

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attacke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03641 Published 2008-11-13 Fixed CWE-91

TI-2008-04775 CVE-2008-5022 · GHSA-49p4-3jx5-xgmj

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox…

LOW 38

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-orig…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03029 Published 2008-11-13 Fixed CWE-287

TI-2008-04770 CVE-2008-5016 · GHSA-9gm5-4h53-36xh

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18…

LOW 27

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an as…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02271 Published 2008-11-13 Fixed CWE-399

TI-2008-04766 CVE-2008-5012 · GHSA-hfvm-r385-4pvq

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x…

LOW 27

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attac…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02026 Published 2008-11-13 Fixed CWE-200