Red Hat Security Advisory

RHSA-2009:0258

thunderbird security update

Released 2009-03-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-19.el4, thunderbird-1.5.0.12-19.el4.i386, thunderbird-1.5.0.12-19.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-2.0.0.21-1.el5, thunderbird-2.0.0.21-1.el5.i386
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-19.el4, thunderbird-1.5.0.12-19.el4.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-19.el4, thunderbird-1.5.0.12-19.el4.i386, thunderbird-1.5.0.12-19.el4.ia64
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-2.0.0.21-1.el5, thunderbird-2.0.0.21-1.el5.i386
Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-19.el4, thunderbird-1.5.0.12-19.el4.i386, thunderbird-1.5.0.12-19.el4.ia64

Fixes 7 records

TI-2009-00740 CVE-2009-0775 · GHSA-rgh3-gqjf-4mqv

Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 50

Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a pa…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04709 Published 2009-03-05 Fixed CWE-399

TI-2009-00333 CVE-2009-0353 · GHSA-xmr3-m6h9-383p

Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before…

MEDIUM 50

Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or po…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04331 Published 2009-02-04 Fixed CWE-399

TI-2009-00332 CVE-2009-0352 · GHSA-f6h6-jfpf-wgvv

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird…

MEDIUM 50

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application cr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04331 Published 2009-02-04 Fixed CWE-399

TI-2009-00739 CVE-2009-0774 · GHSA-7366-2x8r-hhqr

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 47

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04047 Published 2009-03-05 Fixed CWE-399

TI-2009-00737 CVE-2009-0772 · GHSA-fxj6-x384-78f9

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 46

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03722 Published 2009-03-05 Fixed CWE-399

TI-2009-00741 CVE-2009-0776 · GHSA-rq9h-6m6h-p32x

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey…

LOW 34

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain re…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.016 Published 2009-03-05 Fixed CWE-200

TI-2009-00335 CVE-2009-0355 · GHSA-h2q7-pj3w-pr6f

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not…

LOW 28

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary…

CVSS 2.0MEDIUM 5.4 Network No auth Interaction — EPSS 0.01635 Published 2009-02-04 Fixed CWE-264