Red Hat Security Advisory

RHSA-2014:0449

thunderbird security update

Released 2014-04-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-24.5.0-1.el5_10, thunderbird-24.5.0-1.el5_10.i386
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-24.5.0-1.el6_5
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-24.5.0-1.el5_10, thunderbird-24.5.0-1.el5_10.i386
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-24.5.0-1.el6_5
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-24.5.0-1.el6_5

Fixes 7 records

TI-2014-01178 CVE-2014-1524 · GHSA-c496-q9f8-gv47

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0…

MEDIUM 53

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07686 Published 2014-04-30 Fixed CWE-120

TI-2014-01186 CVE-2014-1532 · GHSA-74g6-hx95-wj53

Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function…

MEDIUM 50

Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0461 Published 2014-04-30 Fixed CWE-416

TI-2014-01185 CVE-2014-1531 · GHSA-8fx2-5vw6-974x

Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function…

MEDIUM 47

Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote att…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05568 Published 2014-04-30 Fixed CWE-416

TI-2014-01173 CVE-2014-1518 · GHSA-49rq-vv34-q63r

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 47

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of serv…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05958 Published 2014-04-30 Fixed

TI-2014-01183 CVE-2014-1529 · GHSA-vcpc-r52j-cpgq

The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5…

MEDIUM 44

The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execu…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03736 Published 2014-04-30 Fixed CWE-269

TI-2014-01177 CVE-2014-1523 · GHSA-2gmr-x2wc-4g5j

Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0…

LOW 35

Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (o…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.03149 Published 2014-04-30 Fixed CWE-787

TI-2014-01184 CVE-2014-1530 · GHSA-rmp2-6gvc-xxrf

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5…

LOW 31

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0166 Published 2014-04-30 Fixed CWE-79