Red Hat Security Advisory

RHSA-2011:0887

thunderbird security update

Released 2011-06-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 thunderbird-1.5.0.12-39.el4, thunderbird-1.5.0.12-39.el4.i386, thunderbird-1.5.0.12-39.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-2.0.0.24-18.el5_6, thunderbird-2.0.0.24-18.el5_6.i386
Red Hat Enterprise Linux Desktop version 4 thunderbird-1.5.0.12-39.el4, thunderbird-1.5.0.12-39.el4.i386
Red Hat Enterprise Linux ES version 4 thunderbird-1.5.0.12-39.el4, thunderbird-1.5.0.12-39.el4.i386, thunderbird-1.5.0.12-39.el4.ia64
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-2.0.0.24-18.el5_6, thunderbird-2.0.0.24-18.el5_6.i386
Red Hat Enterprise Linux WS version 4 thunderbird-1.5.0.12-39.el4, thunderbird-1.5.0.12-39.el4.i386, thunderbird-1.5.0.12-39.el4.ia64

Fixes 13 records

TI-2011-02075 CVE-2011-2371 · GHSA-2ph2-r6cr-hgrj

Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x…

HIGH 82

Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vecto…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.75691 Published 2011-06-30 Partial fix CWE-189

TI-2011-02067 CVE-2011-2363 · GHSA-xx6j-mphq-3862

Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the…

MEDIUM 52

Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remot…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2011-06-30 Fixed CWE-399

TI-2011-00078 CVE-2011-0083 · GHSA-g9rw-p28v-vm76

Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the…

MEDIUM 52

Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remot…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05772 Published 2011-06-30 Fixed CWE-399

TI-2011-02079 CVE-2011-2375 · GHSA-4v3g-f433-532p

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 5.0…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 5.0 and Thunderbird through 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or pos…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05505 Published 2011-06-30 Fixed

TI-2011-02078 CVE-2011-2374 · GHSA-8jc9-3jcx-j7x6

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allow remote attackers to cause a denial of service (memory corruption and…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05459 Published 2011-06-30 Fixed

TI-2011-02069 CVE-2011-2365 · GHSA-3jmq-gj9r-gh7x

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18…

MEDIUM 51

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possi…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05655 Published 2011-06-30 Fixed

TI-2011-02068 CVE-2011-2364 · GHSA-r27c-hh5c-3f96

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18…

MEDIUM 51

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05459 Published 2011-06-30 Fixed

TI-2011-00080 CVE-2011-0085 · GHSA-mvwq-v22m-89qj

Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox…

MEDIUM 51

Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafte…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05572 Published 2011-06-30 Fixed CWE-399

TI-2011-02080 CVE-2011-2376 · GHSA-m63c-4mc5-cqx3

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 50

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and Thunderbird before 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or p…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04372 Published 2011-06-30 Fixed

TI-2011-02077 CVE-2011-2373 · GHSA-2g6x-7c5j-qpjf

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1…

MEDIUM 41

Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.0496 Published 2011-06-30 Partial fix CWE-399

TI-2011-02081 CVE-2011-2377 · GHSA-v2pm-qf2g-3x86

Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and…

LOW 29

Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execu…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03769 Published 2011-06-30 Fixed CWE-119

TI-2011-02066 CVE-2011-2362 · GHSA-94rr-f3c7-jj57

Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do…

LOW 26

Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01777 Published 2011-06-30 Fixed CWE-264

TI-2011-02267 CVE-2011-2605 · GHSA-m4ch-8pc5-rpx2

CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in…

LOW 22

CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows re…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01034 Published 2011-06-30 Fixed CWE-94