Red Hat Security Advisory

RHSA-2013:1480

thunderbird security update

Released 2013-10-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-17.0.10-1.el5_10, thunderbird-17.0.10-1.el5_10.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-17.0.10-1.el6_4
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-17.0.10-1.el5_10, thunderbird-17.0.10-1.el5_10.i386
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-17.0.10-1.el6_4
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-17.0.10-1.el6_4

Fixes 8 records

TI-2013-04783 CVE-2013-5597 · GHSA-h685-5vjr-p4m8

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla…

MEDIUM 52

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06273 Published 2013-10-30 Fixed

TI-2013-04788 CVE-2013-5602 · GHSA-8rq9-mgjw-g998

The Worker::SetEventListener function in the Web workers implementation in Mozilla…

MEDIUM 51

The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10,…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05166 Published 2013-10-30 Fixed CWE-119

TI-2013-04787 CVE-2013-5601 · GHSA-5x6f-2xcq-3hwq

Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in…

MEDIUM 51

Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x bef…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05301 Published 2013-10-30 Fixed

TI-2013-04786 CVE-2013-5600 · GHSA-qp2f-2pc9-9qph

Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function…

MEDIUM 51

Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05347 Published 2013-10-30 Fixed

TI-2013-04785 CVE-2013-5599 · GHSA-hv5q-6ffq-rj2h

Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the…

MEDIUM 51

Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thu…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05194 Published 2013-10-30 Fixed

TI-2013-04776 CVE-2013-5590 · GHSA-v3c2-c4wx-r4cg

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05238 Published 2013-10-30 Fixed

TI-2013-04790 CVE-2013-5604 · GHSA-95cx-92pf-pxrr

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before…

MEDIUM 49

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaM…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06493 Published 2013-10-30 Fixed CWE-119

TI-2013-04781 CVE-2013-5595 · GHSA-c8rm-xfhj-7h6v

The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and…

LOW 24

The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly alloca…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02088 Published 2013-10-30 Fixed CWE-119