Red Hat Security Advisory

RHSA-2013:1142

thunderbird security update

Released 2013-08-07 · Red Hat rating Important · View on Red Hat →

Fixed in

RHEL Optional Productivity Applications (v. 5 server) thunderbird-17.0.8-5.el5_9, thunderbird-17.0.8-5.el5_9.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-17.0.8-5.el6_4
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-17.0.8-5.el6_4
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-17.0.8-5.el6_4

Fixes 6 records

TI-2013-01505 CVE-2013-1710 · GHSA-q7cm-8gjh-863h

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x…

HIGH 71

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.41711 Published 2013-08-07 Partial fix CWE-20

TI-2013-01497 CVE-2013-1701 · GHSA-mqv6-w9c5-2g74

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 50

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allow re…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04587 Published 2013-08-07 Partial fix

TI-2013-01511 CVE-2013-1717 · GHSA-jvg5-p24q-p89x

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8…

LOW 29

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, whic…

CVSS 2.0MEDIUM 5.4 Network No auth Interaction — EPSS 0.02404 Published 2013-08-07 Partial fix CWE-264

TI-2013-01509 CVE-2013-1714 · GHSA-p7q2-jcwm-cgcm

The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before…

LOW 24

The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 does not properly restrict XMLHttpRe…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02091 Published 2013-08-07 Partial fix CWE-264

TI-2013-01508 CVE-2013-1713 · GHSA-pjg7-3h5g-h9f9

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8…

LOW 23

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0162 Published 2013-08-07 Partial fix CWE-264

TI-2013-01504 CVE-2013-1709 · GHSA-2rh5-2m29-rxgg

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8…

LOW 23

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and hist…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01331 Published 2013-08-07 Partial fix CWE-79