Test ID:	1.3.6.1.4.1.25623.1.1.10.2017.0039
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2017-0039)
Summary:	The remote host is missing an update for the 'thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2017-0039 advisory.
Description:	Summary: The remote host is missing an update for the 'thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2017-0039 advisory. Vulnerability Insight: JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. (CVE-2017-5375) Use-after-free while manipulating XSL in XSLT documents. (CVE-2017-5376) Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. (CVE-2017-5378) A potential use-after-free found through fuzzing during DOM manipulation of SVG content. (CVE-2017-5380) The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. (CVE-2017-5390) A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. (CVE-2017-5396) URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. (CVE-2017-5383) Mozilla developers and community members Christian Holler, Gary Kwong, Andre Bargull, Jan de Mooij, Tom Schuster, and Oriol reported memory safety bugs present in Thunderbird 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-5373) Affected Software/OS: 'thunderbird, thunderbird-l10n' package(s) on Mageia 5. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-5373 BugTraq ID: 95762 http://www.securityfocus.com/bid/95762 Debian Security Information: DSA-3771 (Google Search) https://www.debian.org/security/2017/dsa-3771 Debian Security Information: DSA-3832 (Google Search) https://www.debian.org/security/2017/dsa-3832 https://security.gentoo.org/glsa/201702-13 https://security.gentoo.org/glsa/201702-22 RedHat Security Advisories: RHSA-2017:0190 http://rhn.redhat.com/errata/RHSA-2017-0190.html RedHat Security Advisories: RHSA-2017:0238 http://rhn.redhat.com/errata/RHSA-2017-0238.html http://www.securitytracker.com/id/1037693 Common Vulnerability Exposure (CVE) ID: CVE-2017-5375 BugTraq ID: 95757 http://www.securityfocus.com/bid/95757 https://www.exploit-db.com/exploits/42327/ https://www.exploit-db.com/exploits/44293/ https://www.exploit-db.com/exploits/44294/ Common Vulnerability Exposure (CVE) ID: CVE-2017-5376 BugTraq ID: 95758 http://www.securityfocus.com/bid/95758 Common Vulnerability Exposure (CVE) ID: CVE-2017-5378 BugTraq ID: 95769 http://www.securityfocus.com/bid/95769 Common Vulnerability Exposure (CVE) ID: CVE-2017-5380 Common Vulnerability Exposure (CVE) ID: CVE-2017-5383 Common Vulnerability Exposure (CVE) ID: CVE-2017-5390 Common Vulnerability Exposure (CVE) ID: CVE-2017-5396
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.