=========================================================== Ubuntu Security Notice USN-605-1 May 06, 2008 mozilla-thunderbird, thunderbird vulnerabilities CVE-2008-1233, CVE-2008-1234, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1 Ubuntu 7.04: mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1 Ubuntu 7.10: thunderbird 2.0.0.14+nobinonly-0ubuntu0.7.10.0 Ubuntu 8.04 LTS: thunderbird 2.0.0.14+nobinonly-0ubuntu0.8.04.1 After a standard system upgrade you need to restart Thunderbird to effect the necessary changes. Details follow: Various flaws were discovered in the JavaScript engine. If a user had JavaScript enabled and were tricked into opening a malicious email, an attacker could escalate privileges within Thunderbird, perform cross-site scripting attacks and/or execute arbitrary code with the user's privileges. (CVE-2008-1233, CVE-2008-1234, CVE-2008-1235) Several problems were discovered in Thunderbird which could lead to crashes and memory corruption. If a user had JavaScript enabled and were tricked into opening a malicious email, an attacker may be able to execute arbitrary code with the user's privileges. (CVE-2008-1236, CVE-2008-1237) Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1.diff.gz Size/MD5: 457657 48dceff6c907f52c6bdada3e0ea6aad3 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1.dsc Size/MD5: 1680 ddc392ac01973ea14cad001627a86f00 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a.orig.tar.gz Size/MD5: 36914467 580341c15311818906389c7f2dac6b11 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_amd64.deb Size/MD5: 3592440 fe9a6764dc14f9c4272d35a8bcd6314e http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_amd64.deb Size/MD5: 194864 597dc91bcd8d496d191bb7a688e28306 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_amd64.deb Size/MD5: 60092 114a3dd54c7620316b093c040bdab08a http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_amd64.deb Size/MD5: 12113732 e84179e1553cb9ae2548af80e544faaf i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_i386.deb Size/MD5: 3585706 10e50da73cad4dcf9773b912a5eba49c http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_i386.deb Size/MD5: 188232 8af005dd712c1b051db4a83c4ccd61dc http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_i386.deb Size/MD5: 55598 cb5ccac7393841668b0beb9545370795 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_i386.deb Size/MD5: 10388228 410e98d078e21bc463e9f735169155cb powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_powerpc.deb Size/MD5: 3590922 ebb7aa0c931370088c154a6e69744bf8 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_powerpc.deb Size/MD5: 191554 76fe4d0d1bd711f6777790b7c287f5ff http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_powerpc.deb Size/MD5: 59200 45589cc27deb4bf73552474b61854b11 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_powerpc.deb Size/MD5: 11667086 9b2fbd4f5faa2347574245d8c6f9adb8 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_sparc.deb Size/MD5: 3587546 fa020e6aba6e897f56b602451ee36168 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_sparc.deb Size/MD5: 189016 e017e7f5b53a164d8cdecba9de529d22 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_sparc.deb Size/MD5: 57088 ca9a3a96c3667687579f06b7687ad4e8 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.6.06.1_sparc.deb Size/MD5: 10859212 0d48e0132c2230bffd1b6d53c77e92aa Updated packages for Ubuntu 7.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1.diff.gz Size/MD5: 127463 eaf25a0741cc928f93c54f61fe26bfed http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1.dsc Size/MD5: 1680 70494f2ba2efcd33cbd3296bfef7fb46 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a.orig.tar.gz Size/MD5: 36914467 580341c15311818906389c7f2dac6b11 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_amd64.deb Size/MD5: 3592690 b7ab22aab5329a6465c5e5dd4b975649 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_amd64.deb Size/MD5: 195482 466c9bc56b389495037be7a91d9bd954 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_amd64.deb Size/MD5: 60604 4072b5ab59eb4cebf3b16d3a8257b0f1 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_amd64.deb Size/MD5: 12208772 b5450452cd4d4e213bd3bf23874daba2 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_i386.deb Size/MD5: 3589866 f7b9eaf7668f5f20ad70a297ba8c04e7 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_i386.deb Size/MD5: 190134 1aaf518b8bdd01353087ccc8aca7149c http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_i386.deb Size/MD5: 57208 94558fddea657e87570c9e3e6d889678 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_i386.deb Size/MD5: 10931756 ebc559ad5456877fb6fa8c95e7e8915d powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_powerpc.deb Size/MD5: 3593618 6730134b72f5c1be9b5fccf8395048be http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_powerpc.deb Size/MD5: 193612 5708a53bf3c79918ba42ef91bd028cb7 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_powerpc.deb Size/MD5: 60602 6f04e7a29a23ac01dc07fd3d94c952e6 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_powerpc.deb Size/MD5: 12146596 06de3afc040618f16359e3f1532984db sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_sparc.deb Size/MD5: 3589038 4ce5e0771d3647fa94f694dad8560a34 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_sparc.deb Size/MD5: 189946 eebc05a0ec7cd14bf55ce413696f62ab http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_sparc.deb Size/MD5: 57654 71b0dfd7eab5ad12267bd5d92bcfb326 http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080417a-0ubuntu0.7.04.1_sparc.deb Size/MD5: 11159832 80c507d8acb2067ec79648ea06de4a28 Updated packages for Ubuntu 7.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0.diff.gz Size/MD5: 126159 34a324737a92f47f767f0b42d91849c5 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0.dsc Size/MD5: 1833 fd03b8fdad5232414b76baef4bd5ac7b http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly.orig.tar.gz Size/MD5: 34976333 ac1177f73a03365f5a7aeda8c89ada1a Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_all.deb Size/MD5: 59952 17df1d55a002bc33d85016e292096c12 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_all.deb Size/MD5: 59944 ffe7a3d245a5258d0c2e6093dd2facab amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_amd64.deb Size/MD5: 3775264 7cb0a055ee57f166f13dcad646859b31 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.7.10.0_amd64.deb Size/MD5: 85134 81d8225a30984b08d822692c7acdb611 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_amd64.deb Size/MD5: 12406884 4c79f63e3a9094935b0d603aaa495285 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_i386.deb Size/MD5: 3763940 bcf101cd02527a9960e65b16b53ac939 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.7.10.0_i386.deb Size/MD5: 80484 e0389b4844e39b711784bafaf6c03a75 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_i386.deb Size/MD5: 10980130 ada60788fb9ac59d0ef8952f97780031 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_lpia.deb Size/MD5: 3761528 56cb98d2409fa7a702917908210f1f57 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.7.10.0_lpia.deb Size/MD5: 80212 2b19ebd76773f197d2c781e64431cb37 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_lpia.deb Size/MD5: 10825168 f2ee5497efebddd8e3775eaac6fff482 powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_powerpc.deb Size/MD5: 3779084 0e6961a7143c0047750f5e8bbca782c5 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.7.10.0_powerpc.deb Size/MD5: 83500 ce6f98c8ac1012036ba8fb2f149328bb http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_powerpc.deb Size/MD5: 12257182 7c40ce1221b63dd071147acc7cdf8345 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.7.10.0_sparc.deb Size/MD5: 3760830 824a9d19d310fb41327747300aa03564 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.7.10.0_sparc.deb Size/MD5: 79880 5b379ce13b756155d34092691cd75467 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.7.10.0_sparc.deb Size/MD5: 11248816 4e55880d3ccafce05558f3ec6fb9984d Updated packages for Ubuntu 8.04 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1.diff.gz Size/MD5: 129599 abaaa83955232ab0ea51ddd227755821 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1.dsc Size/MD5: 1831 18cf2c031a1f2408e54017a57a5be5c3 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly.orig.tar.gz Size/MD5: 34976333 ac1177f73a03365f5a7aeda8c89ada1a Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_all.deb Size/MD5: 60284 3a2f4df73f0c9b099e835a03fee11675 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_all.deb Size/MD5: 60270 7c3d3398f82bfe42b693efd5a6367187 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_amd64.deb Size/MD5: 3776112 8a9fad6939f5f2d0a0827631648e4024 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.8.04.1_amd64.deb Size/MD5: 85154 432756260308765bb3a26277da247d1a http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_amd64.deb Size/MD5: 12394866 4cfbcc388b4836d9318112e5f90711fe i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_i386.deb Size/MD5: 3764374 d28d079780acd9ad3c8bbdacc0ec30e8 http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.8.04.1_i386.deb Size/MD5: 80572 28e71f02720fba9711f8d3f1649829cf http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_i386.deb Size/MD5: 10967510 5ffd1cec8dbd3a2ccb03b52aca03da87 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_lpia.deb Size/MD5: 3762104 e1e54b6a0e3208f802cac05692ea0e45 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.8.04.1_lpia.deb Size/MD5: 80292 d676ef32bb9db0ab307221652cb16f14 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_lpia.deb Size/MD5: 10812128 e802b424fd463e5ada6dd624c0bd3e26 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_powerpc.deb Size/MD5: 3780038 5c6001c7968f9eb3f4f878a08d1007ce http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.8.04.1_powerpc.deb Size/MD5: 83538 b0a754f34a048520e1ed2cae4467e285 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_powerpc.deb Size/MD5: 12239658 e1f30785d5c775ec111576f4d66a0226 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.14+nobinonly-0ubuntu0.8.04.1_sparc.deb Size/MD5: 3761824 abeb318ec41194b57242af4588c810fe http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.14+nobinonly-0ubuntu0.8.04.1_sparc.deb Size/MD5: 79996 ec3bfea62a9c67915981705560cbdd51 http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.14+nobinonly-0ubuntu0.8.04.1_sparc.deb Size/MD5: 11235976 02e7241dfddf5d112da5c17eb2832de7