English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 76783 CVE descriptions
and 40246 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.68234
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-978-2 (thunderbird)
Summary:Ubuntu USN-978-2 (thunderbird)
Description:The remote host is missing an update to thunderbird
announced via advisory USN-978-2.

Details follow:

USN-978-1 fixed vulnerabilities in Thunderbird. Some users reported
stability problems under certain circumstances. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

Several dangling pointer vulnerabilities were discovered in Thunderbird. An
attacker could exploit this to crash Thunderbird or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)

It was discovered that the XPCSafeJSObjectWrapper (SJOW) security wrapper
did not always honor the same-origin policy. If JavaScript was enabled, an
attacker could exploit this to run untrusted JavaScript from other domains.
(CVE-2010-2763)

Matt Haggard discovered that Thunderbird did not honor same-origin policy
when processing the statusText property of an XMLHttpRequest object. If a
user were tricked into viewing a malicious site, a remote attacker could
use this to gather information about servers on internal private networks.
(CVE-2010-2764)

Chris Rohlf discovered an integer overflow when Thunderbird processed the
HTML frameset element. If a user were tricked into viewing a malicious
site, a remote attacker could use this to crash Thunderbird or possibly run
arbitrary code as the user invoking the program. (CVE-2010-2765)

Several issues were discovered in the browser engine. If a user were
tricked into viewing a malicious site, a remote attacker could use this to
crash Thunderbird or possibly run arbitrary code as the user invoking the
program. (CVE-2010-2766, CVE-2010-3168)

David Huang and Collin Jackson discovered that the tag could
override the charset of a framed HTML document in another origin. An
attacker could utilize this to perform cross-site scripting attacks.
(CVE-2010-2768)

Paul Stone discovered that with designMode enabled an HTML selection
containing JavaScript could be copied and pasted into a document and have
the JavaScript execute within the context of the site where the code was
dropped. If JavaScript was enabled, an attacker could utilize this to
perform cross-site scripting attacks. (CVE-2010-2769)

A buffer overflow was discovered in Thunderbird when processing text runs.
If a user were tricked into viewing a malicious site, a remote attacker
could use this to crash Thunderbird or possibly run arbitrary code as the
user invoking the program. (CVE-2010-3166)

Peter Van der Beken, Jason Oster, Jesse Ruderman, Igor Bukanov, Jeff
Walden, Gary Kwong and Olli Pettay discovered several flaws in the
browser engine. If a user were tricked into viewing a malicious site, a
remote attacker could use this to crash Thunderbird or possibly run
arbitrary code as the user invoking the program. (CVE-2010-3169)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.04 LTS:
thunderbird 3.0.8+build2+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-978-2

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-2760
Debian Security Information: DSA-2106 (Google Search)
http://www.debian.org/security/2010/dsa-2106
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:173
SuSE Security Announcement: SUSE-SA:2010:049 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11799
http://secunia.com/advisories/42867
http://www.vupen.com/english/advisories/2010/2323
http://www.vupen.com/english/advisories/2011/0061
XForce ISS Database: mozilla-nstreeselection-code-execution(61660)
http://xforce.iss.net/xforce/xfdb/61660
Common Vulnerability Exposure (CVE) ID: CVE-2010-2767
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11969
XForce ISS Database: mozilla-pointer-code-execution(61658)
http://xforce.iss.net/xforce/xfdb/61658
Common Vulnerability Exposure (CVE) ID: CVE-2010-3167
http://www.zerodayinitiative.com/advisories/ZDI-10-171/
BugTraq ID: 43097
http://www.securityfocus.com/bid/43097
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12136
XForce ISS Database: mozilla-nstreecontentview-code-execution(61661)
http://xforce.iss.net/xforce/xfdb/61661
Common Vulnerability Exposure (CVE) ID: CVE-2010-2763
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12114
XForce ISS Database: firefox-sjow-security-bypass(61665)
http://xforce.iss.net/xforce/xfdb/61665
Common Vulnerability Exposure (CVE) ID: CVE-2010-2764
BugTraq ID: 43104
http://www.securityfocus.com/bid/43104
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11684
XForce ISS Database: firefox-xmlhttprequest-info-disclosure(61662)
http://xforce.iss.net/xforce/xfdb/61662
Common Vulnerability Exposure (CVE) ID: CVE-2010-2765
BugTraq ID: 43095
http://www.securityfocus.com/bid/43095
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11519
Common Vulnerability Exposure (CVE) ID: CVE-2010-2766
http://www.zerodayinitiative.com/advisories/ZDI-10-176/
BugTraq ID: 43100
http://www.securityfocus.com/bid/43100
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11778
Common Vulnerability Exposure (CVE) ID: CVE-2010-3168
BugTraq ID: 43108
http://www.securityfocus.com/bid/43108
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12001
XForce ISS Database: firefox-xultree-objects-code-exec(61653)
http://xforce.iss.net/xforce/xfdb/61653
Common Vulnerability Exposure (CVE) ID: CVE-2010-2768
BugTraq ID: 43101
http://www.securityfocus.com/bid/43101
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11735
Common Vulnerability Exposure (CVE) ID: CVE-2010-2769
BugTraq ID: 43106
http://www.securityfocus.com/bid/43106
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12192
Common Vulnerability Exposure (CVE) ID: CVE-2010-3166
BugTraq ID: 43102
http://www.securityfocus.com/bid/43102
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12186
Common Vulnerability Exposure (CVE) ID: CVE-2010-3169
BugTraq ID: 43118
http://www.securityfocus.com/bid/43118
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12145
XForce ISS Database: mozilla-safety-code-execution(61657)
http://xforce.iss.net/xforce/xfdb/61657
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 40246 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.