[arch-security] [ASA-201609-3] thunderbird: arbitrary code execution
rgacogne at archlinux.org
Sun Sep 4 18:03:52 UTC 2016
Arch Linux Security Advisory ASA-201609-3
Date : 2016-09-04
CVE-ID : CVE-2016-2835 CVE-2016-2836
Package : thunderbird
Type : arbitrary code execution
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package thunderbird before version 45.3.0-1 is vulnerable to
arbitrary code execution.
Upgrade to 45.3.0-1.
# pacman -Syu "thunderbird>=45.3.0-1"
The problems have been fixed upstream in version 45.3.0.
- CVE-2016-2835 (arbitrary code execution)
Carsten Book, Christian Holler, Gary Kwong, Jesse Ruderman, Andrew
McCreight, Phil Ringnalda and Philipp reported memory safety problems
- CVE-2016-2836 (arbitrary code execution)
Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, and Julian
Seward reported memory safety problems and crashes.
A remote attacker can execute arbitrary code on the affected host.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security