[arch-security] [ASA-201711-43] thunderbird: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201711-43
==========================================

Severity: Critical
Date    : 2017-11-30
CVE-ID  : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-530

Summary
=======

The package thunderbird before version 52.5.0-1 is vulnerable to
multiple issues including arbitrary code execution and same-origin
policy bypass.

Resolution
==========

Upgrade to 52.5.0-1.

# pacman -Syu "thunderbird>=52.5.0-1"

The problems have been fixed upstream in version 52.5.0.

Workaround
==========

None.

Description
===========

- CVE-2017-7826 (arbitrary code execution)

Several reported memory safety bugs have been found in Firefox before
57.0 and Thunderbird before 52.5. Some of these bugs showed evidence of
memory corruption and with enough effort some of these could probably
be exploited to run arbitrary code.

- CVE-2017-7828 (arbitrary code execution)

A use-after-free vulnerability can occur in Firefox before 57.0 and
Thunderbird before 52.5 when flushing and resizing layout because the
PressShell object has been freed while still in use. This results in a
potentially exploitable crash during these operations.

- CVE-2017-7830 (same-origin policy bypass)

The Resource Timing API in Firefox before 57.0 and Thunderbird before
52.5 incorrectly revealed navigations in cross-origin iframes. This is
a same-origin policy violation and could allow for data theft of URLs
loaded by users.

Impact
======

A remote attacker is able to bypass same-origin policy restrictions or
execute arbitrary code on the affected host.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1394530%2C1369561%2C1411458%2C1400003%2C1395138%2C1408412%2C1393840%2C1400763%2C1339259%2C1394265%2C1407740%2C1407751%2C1408005%2C1406398%2C1387799%2C1261175%2C1400554%2C1375146%2C1397811%2C1404636%2C1401804
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
https://bugzilla.mozilla.org/show_bug.cgi?id=1406750
https://bugzilla.mozilla.org/show_bug.cgi?id=1412252
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
https://bugzilla.mozilla.org/show_bug.cgi?id=1408990
https://security.archlinux.org/CVE-2017-7826
https://security.archlinux.org/CVE-2017-7828
https://security.archlinux.org/CVE-2017-7830

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 866 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171201/7f0d1367/attachment.asc>