| Description: | Mozilla Thunderbird is a standalone mail and newsgroup client.Several flaws were found in the processing of malformed content. Maliciouscontent could cause Thunderbird to crash or, potentially, execute arbitrarycode with the privileges of the user running Thunderbird. (CVE-2013-1701)A flaw was found in the way Thunderbird generated Certificate RequestMessage Format (CRMF) requests. An attacker could use this flaw to performcross-site scripting (XSS) attacks or execute arbitrary code with theprivileges of the user running Thunderbird. (CVE-2013-1710)A flaw was found in the way Thunderbird handled the interaction betweenframes and browser history. An attacker could use this flaw to trickThunderbird into treating malicious content as if it came from the browserhistory, allowing for XSS attacks. (CVE-2013-1709)It was found that the same-origin policy could be bypassed due to the wayUniform Resource Identifiers (URI) were checked in JavaScript. An attackercould use this flaw to perform XSS attacks, or install malicious add-onsfrom third-party pages. (CVE-2013-1713)It was found that web workers could bypass the same-origin policy. Anattacker could use this flaw to perform XSS attacks. (CVE-2013-1714)It was found that, in certain circumstances, Thunderbird incorrectlyhandled Java applets. If a user launched an untrusted Java applet viaThunderbird, the applet could use this flaw to obtain read-only access tofiles on the user's local system. (CVE-2013-1717)Red Hat would like to thank the Mozilla project for reporting these issues.Upstream acknowledges Jeff Gilbert, Henrik Skupin, moz_bug_r_a4, CodyCrews, Federico Lanusse, and Georgi Guninski as the original reporters ofthese issues.Note: All of the above issues cannot be exploited by a specially-craftedHTML mail message as JavaScript is disabled by default for mail messages.They could be exploited another way in Thunderbird, for example, whenviewing the full remote content of an RSS feed.All Thunderbird users should upgrade to this updated package, whichcontains Thunderbird version 17.0.8 ESR, which corrects these issues. Afterinstalling the update, Thunderbird must be restarted for the changes totake effect. |