Red Hat Security Advisory

RHSA-2013:0821

thunderbird security update

Released 2013-05-14 · Red Hat rating Important · View on Red Hat →

Fixed in

RHEL Optional Productivity Applications (v. 5 server) thunderbird-17.0.6-1.el5_9, thunderbird-17.0.6-1.el5_9.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-17.0.6-2.el6_4
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-17.0.6-2.el6_4
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-17.0.6-2.el6_4

Fixes 10 records

TI-2013-01472 CVE-2013-1675 · GHSA-7cv2-f4f9-vw96

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6…

CRITICAL 86KEV

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDO…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.06696 Published 2013-05-16 Partial fix CWE-665

TI-2013-01478 CVE-2013-1681 · GHSA-662v-6659-j7gw

Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in…

MEDIUM 51

Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows re…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05593 Published 2013-05-16 Partial fix CWE-399

TI-2013-01477 CVE-2013-1680 · GHSA-8p39-8gpr-fr9x

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox…

MEDIUM 51

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attacke…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05545 Published 2013-05-16 Partial fix CWE-119

TI-2013-01476 CVE-2013-1679 · GHSA-m7q9-pmrc-hx6r

Use-after-free vulnerability in the mozilla::plugins::child::_geturlnotify function in…

MEDIUM 51

Use-after-free vulnerability in the mozilla::plugins::child::_geturlnotify function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05437 Published 2013-05-16 Partial fix CWE-399

TI-2013-01475 CVE-2013-1678 · GHSA-hmp9-9jqp-f4m7

The _cairo_xlib_surface_add_glyph function in Mozilla Firefox before 21.0, Firefox ESR…

MEDIUM 51

The _cairo_xlib_surface_add_glyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary co…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05502 Published 2013-05-16 Partial fix CWE-119

TI-2013-01474 CVE-2013-1677 · GHSA-r887-g3fw-6c4x

The gfxSkipCharsIterator::SetOffsets function in Mozilla Firefox before 21.0, Firefox ESR…

MEDIUM 51

The gfxSkipCharsIterator::SetOffsets function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05502 Published 2013-05-16 Partial fix CWE-399

TI-2013-01473 CVE-2013-1676 · GHSA-rq2m-8wph-cq2p

The SelectionIterator::GetNextSegment function in Mozilla Firefox before 21.0, Firefox…

MEDIUM 51

The SelectionIterator::GetNextSegment function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrar…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05709 Published 2013-05-16 Partial fix CWE-119

TI-2013-00685 CVE-2013-0801 · GHSA-vxg5-7h3v-fpwg

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allow remote attackers to cause…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05391 Published 2013-05-16 Partial fix

TI-2013-01471 CVE-2013-1674 · GHSA-hq6f-432r-r9gm

Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before…

MEDIUM 49

Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05828 Published 2013-05-16 Partial fix CWE-399

TI-2013-01467 CVE-2013-1670 · GHSA-wmq6-5fp5-6pfg

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox…

LOW 34

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome priv…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.12002 Published 2013-05-16 Partial fix CWE-264