Several security issues were fixed in Thunderbird.
Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1477)
19 February 2014
A security issue affects these releases of Ubuntu and its derivatives:
Several security issues were fixed in Thunderbird.
Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1477)
Cody Crews discovered a method to bypass System Only Wrappers. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential data or execute code with the privileges of the user invoking Thunderbird. (CVE-2014-1479)
Fredrik Lönnqvist discovered a use-after-free in Thunderbird. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the priviliges of the user invoking Thunderbird. (CVE-2014-1482)
Arthur Gerkis discovered a use-after-free in Thunderbird. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the priviliges of the user invoking Thunderbird. (CVE-2014-1486)
Masato Kinugawa discovered a cross-origin information leak in web worker error messages. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information. (CVE-2014-1487)
Several issues were discovered with ticket handling in NSS. An attacker could potentially exploit these to cause a denial of service or bypass cryptographic protection mechanisms. (CVE-2014-1490, CVE-2014-1491)
Boris Zbarsky discovered that security restrictions on window objects could be bypassed under certain circumstances. (CVE-2014-1481)
Fabián Cuchietti and Ateeq ur Rehman Khan discovered that it was possible to bypass Javascript execution restrictions when replying to or forwarding mail messages in certain circumstances. An attacker could potentially exploit this to steal confidential information or modify message content. (CVE-2013-6674)
The problem can be corrected by updating your system to the following package versions:
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart Thunderbird to make all the necessary changes.
Vulmon