[arch-security] [ASA-201502-15] thunderbird: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201502-15
==========================================

Severity: High
Date    : 2015-02-25
CVE-ID  : CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0835
CVE-2015-0836
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package thunderbird before version 31.5.0-1 is vulnerable to
multiple issues including information leak and remote code execution
when used as a web browser.

Resolution
==========

Upgrade to 31.5.0-1.

# pacman -Syu "thunderbird>=31.5.0-1"

The problem has been fixed upstream in version 31.5.0.

Workaround
==========

In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a
risk in browser or browser-like contexts.

Description
===========

- CVE-2015-0822 (information leak):

Security researcher Armin Razmdjou reported that a user readable file in
a known local path could be uploaded to a malicious site. This was done
by manipulating the autocomplete feature in a form and user interaction
with it. While the local file is not visibly uploaded through the form,
its contents are made available through the Document Object Model (DOM)
to script content on the attacking page, leading to information disclosure.

- CVE-2015-0827 (out-of-bounds read and write, possibly leading to
remote code execution)

Security researcher Abhishek Arya (Inferno) of the Google Chrome
Security Team used the Address Sanitizer tool to report an out-of-bounds
read and an out-of-bounds write when rendering an improperly formatted
SVG graphic. This could potentially allow the attacker to read
uninitialized memory.

- CVE-2015-0831 (use-after-free, possibily leading to remote code execution)

Security researcher Paul Bandha used the used the Address Sanitizer tool
to discover a use-after-free vulnerability when running specific web
content with IndexedDB to create an index. This leads to a potentially
exploitable crash.

- CVE-2015-0835, CVE-2015-0836 (remote code execution):

Mozilla developers and community identified and fixed several memory
safety bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.


Impact
======

A remote attacker may be able to access sensitive information or execute
arbitrary code

References
==========

https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150225/a3cfc145/attachment.asc>