English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 61204 CVE descriptions
and 32582 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.68192
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-958-1 (thunderbird)
Summary:Ubuntu USN-958-1 (thunderbird)
Description:The remote host is missing an update to thunderbird
announced via advisory USN-958-1.

Details follow:

Several flaws were discovered in the browser engine of Thunderbird. If a
user were tricked into viewing malicious content, a remote attacker could
use this to crash Thunderbird or possibly run arbitrary code as the user
invoking the program. (CVE-2010-1211, CVE-2010-1212)

An integer overflow was discovered in how Thunderbird processed CSS values.
An attacker could exploit this to crash Thunderbird or possibly run
arbitrary code as the user invoking the program. (CVE-2010-2752)

An integer overflow was discovered in how Thunderbird interpreted the XUL
element. If a user were tricked into viewing malicious content, a remote
attacker could use this to crash Thunderbird or possibly run arbitrary code
as the user invoking the program. (CVE-2010-2753)

Aki Helin discovered that libpng did not properly handle certain malformed
PNG images. If a user were tricked into opening a crafted PNG file, an
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. (CVE-2010-1205)

Yosuke Hasegawa discovered that the same-origin check in Thunderbird could
be bypassed by utilizing the importScripts Web Worker method. If a user
were tricked into viewing malicious content, an attacker could exploit this
to read data from other domains. (CVE-2010-1213)

Chris Evans discovered that Thunderbird did not properly process improper
CSS selectors. If a user were tricked into viewing malicious content, an
attacker could exploit this to read data from other domains.
(CVE-2010-0654)

Soroush Dalili discovered that Thunderbird did not properly handle script
error output. An attacker could use this to access URL parameters from
other domains. (CVE-2010-2754)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.04 LTS:
thunderbird 3.0.6+build2+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-958-1

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-0654
http://code.google.com/p/chromium/issues/detail?id=9877
http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
http://websec.sv.cmu.edu/css/css.pdf
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11811
Common Vulnerability Exposure (CVE) ID: CVE-2010-1205
http://lists.vmware.com/pipermail/security-announce/2010/000105.html
http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
Debian Security Information: DSA-2072 (Google Search)
http://www.debian.org/security/2010/dsa-2072
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:133
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.613061
SuSE Security Announcement: SUSE-SR:2010:017 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://www.ubuntu.com/usn/USN-960-1
BugTraq ID: 41174
http://www.securityfocus.com/bid/41174
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11851
http://secunia.com/advisories/40302
http://secunia.com/advisories/40472
http://secunia.com/advisories/40547
http://secunia.com/advisories/41574
http://secunia.com/advisories/42317
http://secunia.com/advisories/42314
http://secunia.com/advisories/40336
http://www.vupen.com/english/advisories/2010/1612
http://www.vupen.com/english/advisories/2010/1755
http://www.vupen.com/english/advisories/2010/1837
http://www.vupen.com/english/advisories/2010/1846
http://www.vupen.com/english/advisories/2010/1877
http://www.vupen.com/english/advisories/2010/2491
http://www.vupen.com/english/advisories/2010/3045
http://www.vupen.com/english/advisories/2010/3046
http://www.vupen.com/english/advisories/2010/1637
XForce ISS Database: libpng-rowdata-bo(59815)
http://xforce.iss.net/xforce/xfdb/59815
Common Vulnerability Exposure (CVE) ID: CVE-2010-1211
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11552
Common Vulnerability Exposure (CVE) ID: CVE-2010-1212
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11771
Common Vulnerability Exposure (CVE) ID: CVE-2010-1213
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11835
Common Vulnerability Exposure (CVE) ID: CVE-2010-2752
Bugtraq: 20100721 ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/512514
http://www.zerodayinitiative.com/advisories/ZDI-10-133/
BugTraq ID: 41852
http://www.securityfocus.com/bid/41852
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11680
Common Vulnerability Exposure (CVE) ID: CVE-2010-2753
Bugtraq: 20100721 ZDI-10-131: Mozilla Firefox nsTreeSelection Dangling Pointer Remote Code Execution Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/512510
http://www.zerodayinitiative.com/advisories/ZDI-10-131/
SuSE Security Announcement: SUSE-SA:2010:049 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
BugTraq ID: 41853
http://www.securityfocus.com/bid/41853
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10958
Common Vulnerability Exposure (CVE) ID: CVE-2010-2754
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11770
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.