Red Hat Security Advisory

RHSA-2009:0002

thunderbird security update

Released 2009-01-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-18.el4, thunderbird-1.5.0.12-18.el4.i386, thunderbird-1.5.0.12-18.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-2.0.0.19-1.el5_2, thunderbird-2.0.0.19-1.el5_2.i386
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-18.el4, thunderbird-1.5.0.12-18.el4.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-18.el4, thunderbird-1.5.0.12-18.el4.i386, thunderbird-1.5.0.12-18.el4.ia64
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-2.0.0.19-1.el5_2, thunderbird-2.0.0.19-1.el5_2.i386
Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-18.el4, thunderbird-1.5.0.12-18.el4.i386, thunderbird-1.5.0.12-18.el4.ia64

Fixes 10 records

TI-2008-05217 CVE-2008-5500 · GHSA-6h85-mxrc-rvwx

The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19…

MEDIUM 49

The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly tr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03201 Published 2008-12-17 Fixed CWE-399

TI-2008-05228 CVE-2008-5512 · GHSA-3rgf-mp4w-9hj8

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before…

LOW 35

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with c…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02863 Published 2008-12-17 Fixed CWE-264

TI-2008-05223 CVE-2008-5506 · GHSA-rcg4-3qvg-p2xp

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 34

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHt…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02091 Published 2008-12-17 Fixed CWE-264

TI-2008-05224 CVE-2008-5507 · GHSA-q2h5-97m4-jvvg

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 30

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0166 Published 2008-12-17 Fixed CWE-200

TI-2008-05218 CVE-2008-5501 · GHSA-4vx3-3xr8-7q3x

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19…

LOW 29

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03137 Published 2008-12-17 Fixed

TI-2008-05219 CVE-2008-5502 · GHSA-jfx6-pmj2-6ffh

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19…

LOW 27

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corrupt…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0227 Published 2008-12-17 Fixed CWE-399

TI-2008-05229 CVE-2008-5513 · GHSA-wpm2-x35v-w8w6

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before…

LOW 24

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01784 Published 2008-12-17 Fixed CWE-79

TI-2008-05227 CVE-2008-5511 · GHSA-wfgh-c975-36mr

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 24

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01856 Published 2008-12-17 Fixed CWE-79

TI-2008-05225 CVE-2008-5508 · GHSA-ggjv-5q8p-39gf

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 24

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow rem…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02222 Published 2008-12-17 Fixed CWE-20

TI-2008-05220 CVE-2008-5503 · GHSA-xmfc-3wmp-72qq

The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x…

LOW 16

The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allo…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01521 Published 2008-12-17 Fixed