Red Hat Security Advisory

RHSA-2014:0316

thunderbird security update

Released 2014-03-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-24.4.0-1.el5_10, thunderbird-24.4.0-1.el5_10.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-24.4.0-1.el6_5
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-24.4.0-1.el5_10, thunderbird-24.4.0-1.el5_10.i386
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-24.4.0-1.el6_5
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-24.4.0-1.el6_5

Fixes 10 records

TI-2014-01166 CVE-2014-1511 · GHSA-hc98-gcpm-mq7j

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and…

HIGH 83

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83512 Published 2014-03-19 Fixed CWE-269

TI-2014-01165 CVE-2014-1510 · GHSA-xmjr-qq5c-jp94

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4…

HIGH 83

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privile…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82214 Published 2014-03-19 Fixed CWE-269

TI-2014-01167 CVE-2014-1512 · GHSA-9v4g-qfh7-82cm

Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla…

HIGH 66

Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to ex…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.2907 Published 2014-03-19 Fixed CWE-416

TI-2014-01150 CVE-2014-1493 · GHSA-vxg5-46rm-r832

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 53

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of serv…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08033 Published 2014-03-19 Fixed CWE-119

TI-2014-01169 CVE-2014-1514 · GHSA-8jfj-fq3q-fgxw

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4…

MEDIUM 51

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06037 Published 2014-03-19 Fixed CWE-787

TI-2014-01168 CVE-2014-1513 · GHSA-jcgc-g2q4-pjwr

TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4…

MEDIUM 46

TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which a…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05531 Published 2014-03-19 Fixed CWE-787

TI-2014-01164 CVE-2014-1509 · GHSA-53pg-5g3f-5g57

Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in…

MEDIUM 46

Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04989 Published 2014-03-19 Fixed CWE-120

TI-2014-01163 CVE-2014-1508 · GHSA-rfxc-hv24-2vh5

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR…

MEDIUM 46

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from pro…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04235 Published 2014-03-19 Fixed CWE-125

TI-2014-01153 CVE-2014-1497 · GHSA-rjmp-xqqf-h5rc

The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox…

MEDIUM 43

The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information f…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02803 Published 2014-03-19 Fixed CWE-125

TI-2014-01160 CVE-2014-1505 · GHSA-5656-j8pw-q247

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before…

MEDIUM 40

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation informat…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03969 Published 2014-03-19 Fixed CWE-200