CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.2%
CentOS Errata and Security Advisory CESA-2009:1126
Mozilla Thunderbird is a standalone mail and newsgroup client.
Several flaws were found in the processing of malformed HTML mail content.
An HTML mail message containing malicious content could cause Thunderbird
to crash or, potentially, execute arbitrary code as the user running
Thunderbird. (CVE-2009-1392, CVE-2009-1303, CVE-2009-1305, CVE-2009-1833,
CVE-2009-1838)
Several flaws were found in the way malformed HTML mail content was
processed. An HTML mail message containing malicious content could execute
arbitrary JavaScript in the context of the mail message, possibly
presenting misleading data to the user, or stealing sensitive information
such as login credentials. (CVE-2009-1306, CVE-2009-1307, CVE-2009-1308,
CVE-2009-1309)
A flaw was found in the way Thunderbird handled error responses returned
from proxy servers. If an attacker is able to conduct a man-in-the-middle
attack against a Thunderbird instance that is using a proxy server, they
may be able to steal sensitive information from the site Thunderbird is
displaying. (CVE-2009-1836)
Note: JavaScript support is disabled by default in Thunderbird. None of the
above issues are exploitable unless JavaScript is enabled.
All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-June/078173.html
https://lists.centos.org/pipermail/centos-announce/2009-June/078174.html
Affected packages:
thunderbird
Upstream details at:
https://access.redhat.com/errata/RHSA-2009:1126
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | thunderbird | < 2.0.0.22-2.el5.centos | thunderbird-2.0.0.22-2.el5.centos.i386.rpm |
CentOS | 5 | i386 | thunderbird | < 2.0.0.22-2.el5.centos | thunderbird-2.0.0.22-2.el5.centos.i386.rpm |
CentOS | 5 | x86_64 | thunderbird | < 2.0.0.22-2.el5.centos | thunderbird-2.0.0.22-2.el5.centos.x86_64.rpm |
CentOS | 5 | x86_64 | thunderbird | < 2.0.0.22-2.el5.centos | thunderbird-2.0.0.22-2.el5.centos.x86_64.rpm |