Thunderbird: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2017.0204
               Mozilla Foundation Security Advisory 2017-26
                             27 November 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Thunderbird
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2017-7830 CVE-2017-7828 CVE-2017-7826
Member content until: Wednesday, December 27 2017
Reference:            ASB-2017.0199
                      ESB-2017.2968
                      ESB-2017.2947
                      ESB-2017.2946
                      ESB-2017.2920.2

OVERVIEW

        "Security vulnerabilities fixed in Thunderbird 52.5" [1]


IMPACT

        Mozilla has given the following information concerning these 
        vulnerabilities:
        
        "Security vulnerabilities fixed in Thunderbird 52.5
        
        ANNOUNCED
        
        November 23, 2017
        
        IMPACT
        
        CRITICAL
        
        PRODUCTS
        
        Thunderbird
        
        FIXED IN
        
        Thunderbird 52.5
        
        In general, these flaws cannot be exploited through email in the 
        Thunderbird product because scripting is disabled when reading mail,
        but are potentially risks in browser or browser-like contexts.
        
        #CVE-2017-7828: Use-after-free of PressShell while restyling layout
        
        REPORTER	Nils
        
        IMPACT		CRITICAL
        
        Description
        A use-after-free vulnerability can occur when flushing and resizing
        layout because the PressShell object has been freed while still in 
        use. This results in a potentially exploitable crash during these 
        operations.
        
        References
        Bug 1406750
        Bug 1412252
        
        #CVE-2017-7830: Cross-origin URL information leak through Resource 
        Timing API
        
        REPORTER	Jun Kokatsu
        
        IMPACT		HIGH
        
        Description
        The Resource Timing API incorrectly revealed navigations in 
        cross-origin iframes. This is a same-origin policy violation and 
        could allow for data theft of URLs loaded by users.
        
        References
        Bug 1408990
        
        #CVE-2017-7826: Memory safety bugs fixed in Firefox 57, Firefox ESR
        52.5, and Thunderbird 52.5
        
        REPORTER	Mozilla developers and community
        
        IMPACT		CRITICAL
        
        Description
        Mozilla developers and community members Christian Holler, David 
        Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer, 
        Philipp, Nicholas Nethercote, Oriol Brufau, Andr Bargull, Bob Clary,
        Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and Ryan 
        VanderMeulen reported memory safety bugs present in Firefox 56, 
        Firefox ESR 52.4, and Thunderbird 52.4. Some of these bugs showed 
        evidence of memory corruption and we presume that with enough effort
        that some of these could be exploited to run arbitrary code.
        
        References
        Memory safety bugs fixed in Firefox 57, Firefox ESR 52.5, and 
        Thunderbird 52.5" [1]


MITIGATION

        Mozilla recommends updating Thunderbird to version 52.5


REFERENCES

        [1] Mozilla Foundation Security Advisory 2017-26
            https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWhuNc4x+lLeg9Ub1AQiumhAAlsjXG7+0cycaypRc6VcDGcI+mM0e36DP
eA/5P6d4BlzlUvVwwcQO0mwtKtg27kYyCOxzrWELwbm/gN5Nrvoeox0siaff1FX4
P3yluOaWnlJU+SXCeYeib18HoIGuFzLYtw5CsAxq1hRDWut34/OVgFdqvdxyKe+2
U/1b4VtxGmdKRdf+uXCK+VQCz0DWOBlktaRmOuV6YUYhJbOoJcKjdICopGlrL230
W4VGa+BmQSScP/qkaKLKOmWf1vk+Pvua12S+EUz7srgTG+4LaIDyJj5PYGpZF89D
ghlCVr6w9JoL4ZK2xYbNsPWSMb5WPSD+VFyg1EaWPn4E+MnOhK8x9zbp8LLGGzB7
m5ZyuNWikQepYx/z+cl7BlclmspNNYIICIdvL8y8q3w8iCD7iXYGQqow++D+qVpI
OStzlYMbbnHpnKaWQvqQYuLa37fXstu9d7jqBahp8yUOlHz1ZvlkbSam1feTNfFp
yMO4YMrb9utDi0zBHlQpS0ngHv9mWJ3TpocU4WD8SyAzwfoqKMtQ6MvD7eyTo+f2
GAFUoYI0X43Pw00SWDodeqag1rVNcdt7famOtITUb7JWTQteUb0auPKpNYW7PxKz
gFg4wcXf9AM5coCzHd+eElrLJYnogheZYG6OS1nOCJi4CzPQyLNb8ZSwG2bAgzKP
MPd8Yc8+RCM=
=u1Vq
-----END PGP SIGNATURE-----