Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-4513)
Tyson Smith and David Keeler discovered a use-after-poison and buffer overflow in NSS. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7181, CVE-2015-7182)
Ryan Sleevi discovered an integer overflow in NSPR. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7183)
Michał Bentkowski discovered that adding white-space to hostnames that are IP addresses can bypass same-origin protections. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2015-7188)
Looben Yang discovered a buffer overflow during script interactions with the canvas element in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7189)
Shinto K Anto discovered that CORS preflight is bypassed when receiving non-standard Content-Type headers in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2015-7193)
Gustavo Grieco discovered a buffer overflow in libjar in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7194)
Ehsan Akhgari discovered a mechanism for a web worker to bypass secure requirements for web sockets. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could exploit this to bypass the mixed content web socket policy. (CVE-2015-7197)
Ronald Crane discovered several vulnerabilities through code-inspection. If a user were tricked in to opening a specially crafted website in a browser-like context, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7198, CVE-2015-7199, CVE-2015-7200)
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-dbg" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-dbgsym" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-dev" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-dev-dbgsym" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-globalmenu" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-gnome-support" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-gnome-support-dbg" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-af" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ar" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ast" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-be" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-bg" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-bn" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-bn-bd" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-br" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ca" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-cs" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-cy" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-da" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-de" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-dsb" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-el" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-en" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-en-gb" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-en-us" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-es" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-es-ar" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-es-es" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-et" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-eu" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-fi" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-fr" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-fy" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-fy-nl" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ga" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ga-ie" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-gd" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-gl" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-he" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-hr" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-hsb" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-hu" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-hy" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-id" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-is" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-it" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ja" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ka" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ko" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-lt" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-mk" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-nb" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-nb-no" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-nl" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-nn" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-nn-no" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pa" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pa-in" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pl" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pt" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pt-br" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-pt-pt" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-rm" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ro" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ru" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-si" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sk" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sl" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sq" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sr" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sv" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-sv-se" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ta" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-ta-lk" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-tr" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-uk" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-vi" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-zh-cn" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-zh-hans" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-zh-hant" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-locale-zh-tw" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-mozsymbols" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "thunderbird-testsuite" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "xul-ext-calendar-timezones" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "xul-ext-gdata-provider" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "xul-ext-lightning" }, { "binary_version": "1:38.4.0+build3-0ubuntu0.14.04.1", "binary_name": "xul-ext-lightning-dbgsym" } ] }