Red Hat Security Advisory

RHSA-2013:1823

thunderbird security update

Released 2013-12-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-24.2.0-2.el5_10, thunderbird-24.2.0-2.el5_10.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-24.2.0-1.el6_5
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-24.2.0-2.el5_10, thunderbird-24.2.0-2.el5_10.i386
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-24.2.0-1.el6_5
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-24.2.0-1.el6_5

Fixes 9 records

TI-2013-05496 CVE-2013-6671 · GHSA-cqvr-7f3r-7g8c

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR…

MEDIUM 55

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11076 Published 2013-12-11 Fixed CWE-94

TI-2013-04802 CVE-2013-5618 · GHSA-24h5-6vcf-hxw3

Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the…

MEDIUM 55

Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10407 Published 2013-12-11 Fixed CWE-416

TI-2013-04798 CVE-2013-5613 · GHSA-28w2-h994-g9jp

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla…

MEDIUM 54

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to e…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09448 Published 2013-12-11 Fixed CWE-416

TI-2013-04794 CVE-2013-5609 · GHSA-83w9-c7q3-8g5r

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 53

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow remote attackers to cause a denial of serv…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08091 Published 2013-12-11 Fixed

TI-2013-04801 CVE-2013-5616 · GHSA-22j5-vqxp-92q2

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function…

MEDIUM 52

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attac…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06672 Published 2013-12-11 Fixed CWE-416

TI-2013-05499 CVE-2013-6674 · GHSA-f33f-rhvc-q7r2

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8…

LOW 31

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07697 Published 2014-02-17 Fixed CWE-79

TI-2013-00656 CVE-2013-0772 · GHSA-cmfr-58hp-ff9g

The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before…

LOW 30

The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01958 Published 2013-02-19 Fixed CWE-119

TI-2013-04797 CVE-2013-5612 · GHSA-f85h-xqx2-v9xg

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey…

LOW 26

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to inject arbitrary web script or HTML by leveraging a Same Origin Policy violation t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03402 Published 2013-12-11 Fixed CWE-79

TI-2013-04799 CVE-2013-5614 · GHSA-c7p8-vcch-9rf2

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the…

LOW 25

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which allows remote attackers to bypass intended…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02353 Published 2013-12-11 Fixed CWE-1021