[MFSA-2016-96] Security vulnerabilities fixed in Thunderbird 45.6

Severity Critical

Affected Packages 1

Fixed Packages 1

CVEs 8

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6 (critical)
Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
CVE-2016-9895: CSP bypass using marquee tag (high)
Event handlers on <code>marquee</code> elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.
CVE-2016-9897: Memory corruption in libGLES (high)
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES.
CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees (high)
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor.
CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements (critical)
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.
CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs (high)
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of <code>data:</code> URLs. This could allow for cross-domain data leakage.
CVE-2016-9904: Cross-origin information leak in shared atoms (high)
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites.
CVE-2016-9905: Crash in EnumerateSubDocuments (high)
A potentially exploitable crash in <code>EnumerateSubDocuments</code> while adding or removing sub-documents.

Package	Affected Version
pkg:mozilla/Thunderbird	< 45.6

Package	Fixed Version
pkg:mozilla/Thunderbird	= 45.6

ID

MFSA-2016-96

Severity

critical

URL

https://www.mozilla.org/en-US/security/advisories/mfsa2016-96

Published

2016-12-28T00:00:00
(7 years ago)

Modified

2016-12-28T00:00:00
(7 years ago)

Other Advisories

Source	# ID	Name	URL
Bugzilla	1319524	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1319524
Bugzilla	1298773	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1298773
Bugzilla	1299098	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1299098
Bugzilla	1309834	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1309834
Bugzilla	1312609	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1312609
Bugzilla	1313212	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1313212
Bugzilla	1317805	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1317805
Bugzilla	1312548	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1312548
Bugzilla	1315631	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1315631
Bugzilla	1287912	Memory safety bugs fixed in Thunderbird 45.6	https://bugzilla.mozilla.org/show_bug.cgi?id=1287912
Bugzilla	1312272		https://bugzilla.mozilla.org/show_bug.cgi?id=1312272
Bugzilla	1301381		https://bugzilla.mozilla.org/show_bug.cgi?id=1301381
Bugzilla	1314442		https://bugzilla.mozilla.org/show_bug.cgi?id=1314442
Bugzilla	1317409		https://bugzilla.mozilla.org/show_bug.cgi?id=1317409
Bugzilla	1319122		https://bugzilla.mozilla.org/show_bug.cgi?id=1319122
Bugzilla	1317936		https://bugzilla.mozilla.org/show_bug.cgi?id=1317936
Bugzilla	1293985		https://bugzilla.mozilla.org/show_bug.cgi?id=1293985

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:mozilla/Thunderbird		Thunderbird	< 45.6
Fixed	pkg:mozilla/Thunderbird		Thunderbird	= 45.6

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date