Test ID:	1.3.6.1.4.1.25623.1.1.10.2017.0006
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2017-0006)
Summary:	The remote host is missing an update for the 'thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2017-0006 advisory.
Description:	Summary: The remote host is missing an update for the 'thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2017-0006 advisory. Vulnerability Insight: Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption (CVE-2016-9899). Event handlers on marquee elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript (CVE-2016-9895). Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES (CVE-2016-9897). Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor (CVE-2016-9898). External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage (CVE-2016-9900). An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites (CVE-2016-9904). A potentially exploitable crash in EnumerateSubDocuments while adding or removing sub-documents (CVE-2016-9905). Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Thunderbird ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code (CVE-2016-9893). Affected Software/OS: 'thunderbird, thunderbird-l10n' package(s) on Mageia 5. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-9893 BugTraq ID: 94885 http://www.securityfocus.com/bid/94885 Debian Security Information: DSA-3757 (Google Search) https://www.debian.org/security/2017/dsa-3757 https://security.gentoo.org/glsa/201701-15 RedHat Security Advisories: RHSA-2016:2946 http://rhn.redhat.com/errata/RHSA-2016-2946.html RedHat Security Advisories: RHSA-2016:2973 http://rhn.redhat.com/errata/RHSA-2016-2973.html http://www.securitytracker.com/id/1037461 Common Vulnerability Exposure (CVE) ID: CVE-2016-9895 Common Vulnerability Exposure (CVE) ID: CVE-2016-9897 Common Vulnerability Exposure (CVE) ID: CVE-2016-9898 Common Vulnerability Exposure (CVE) ID: CVE-2016-9899 https://www.exploit-db.com/exploits/41042/ Common Vulnerability Exposure (CVE) ID: CVE-2016-9900 Common Vulnerability Exposure (CVE) ID: CVE-2016-9904 Common Vulnerability Exposure (CVE) ID: CVE-2016-9905 BugTraq ID: 94884 http://www.securityfocus.com/bid/94884 http://www.securitytracker.com/id/1037462
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.