TI-2016-08019 CVE-2016-9899 · GHSA-q3mj-v3xc-w732
Use after free in Mozilla Firefox
Priority MEDIUM 61
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.
RHSA-2016:2973
thunderbird security update
Released 2016-12-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) thunderbird-45.6.0-1.el7_3
- Red Hat Enterprise Linux Desktop (v. 5 client) thunderbird-45.6.0-1.el5_11, thunderbird-45.6.0-1.el5_11.i386
- Red Hat Enterprise Linux Desktop (v. 6) thunderbird-45.6.0-1.el6_8
- Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird-45.6.0-1.el5_11, thunderbird-45.6.0-1.el5_11.i386
- Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-45.6.0-1.el6_8
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-45.6.0-1.el7_3
- Red Hat Enterprise Linux Workstation (v. 6) thunderbird-45.6.0-1.el6_8
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-45.6.0-1.el7_3
Fixes 7 records
TI-2016-08021 CVE-2016-9901 · GHSA-6g72-x2jp-6592
Improper input validation in Mozilla Firefox ESR
Priority MEDIUM 47
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API th…
TI-2016-08013 CVE-2016-9893 · GHSA-c8hw-wjgm-chwm
Memory corruption in Mozilla Firefox
Priority MEDIUM 47
Memory safety bugs were reported in Thunderbird 45.5.
TI-2016-08020 CVE-2016-9900 · GHSA-5758-qh2j-cmj3
External resources that should be blocked when loaded by SVG images can bypass security…
Priority MEDIUM 45
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs.
TI-2016-08025 CVE-2016-9905 · GHSA-2f28-6595-fhpf
Improper access control in Mozilla Firefox ESR
Priority MEDIUM 43
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents.
TI-2016-08022 CVE-2016-9902 · GHSA-jhx9-2v44-3f39
Origin validation error in Mozilla Firefox ESR
Priority LOW 35
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events.
TI-2016-08015 CVE-2016-9895 · GHSA-q8q4-9m7f-q3rp
Event handlers on "marquee" elements were executed despite a strict Content Security…
Priority LOW 31
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.