Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2788
thunderbird security update
2 November 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: thunderbird
Publisher: Debian
Operating System: Debian GNU/Linux 8
Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Request Forgery -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-7824 CVE-2017-7823 CVE-2017-7819
CVE-2017-7818 CVE-2017-7814 CVE-2017-7810
CVE-2017-7805 CVE-2017-7793
Reference: ASB-2017.0155
ESB-2017.2594
ESB-2017.2571
ESB-2017.2562
ESB-2017.2559
ESB-2017.2481
Original Bulletin:
http://www.debian.org/security/2017/dsa-4014
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4014-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 01, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : thunderbird
CVE ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814
CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824
Multiple security issues have been found in Thunderbird, which may lead
to the execution of arbitrary code or denial of service.
For the oldstable distribution (jessie), these problems have been fixed
in version 1:52.4.0-1~deb8u1.
For the stable distribution (stretch), these problems have been fixed in
version 1:52.4.0-1~deb9u1.
We recommend that you upgrade your thunderbird packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAln6SF8ACgkQEMKTtsN8
TjbVzA//U90PaixjwoQomGY78HGiDudFRIM54rnMUTqsnuFH8HBifE7+MPmPqj1u
Bt7jJYBVGYCHnOt17kG0SxNN1Za7IFKrpIWP9SNND/vXTIC3ktVERr2oRAzIp9Ad
BgsN3EhxqK7JQxLgFWgY+34jYbp9eSuNQiKlchZ8G9jpXn8CQbNuWrYxOnaPL1EU
CsbMur+QyyFpL/MO6rt1uxMNrxXB1iiM6iaCrGPEGr2foowqVMDK4lkbxVVhI5KB
/X/o53WG7z6lDByHf6FAeB8QmWwz96a/bhm1C6I38SaokU3z+84CADxFL1T/WbVk
vkgW5LPcsYz9v0ckb2WNFjOavxkA1eeo9839TH+goJAIQ8KInSi6WVKkQ5wXUA1S
psovHKJC5prGEn9SMisZoNGeY40Ikax6Y9aR2p+3dzz359cx1tS+D33Au0VcjGRO
MtDcCuSHrEb38qr1/Qu6D+4PNSA/T0051nDR03UP0tDIlxWaTcJ/RFSRlEvVuXLY
NHWkDQ9M3XBARM4v1hdJvI7fpsi6iVZduZWh3mB/A1tyG75fyZFZvKkpltmGAB+O
b8SRM0jY4gX6kSuLcFJpiDu0u/KLdKp3Vr3tOWVfZnRIzfdMNNccfyvyLTAt+KFS
uOJY6e6mTBmd+LE/jplaUNivSg9lLolSF+n75GB4Aa5Gmsx6peg=
=RB0i
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWfqqQox+lLeg9Ub1AQjeOw/9EbsFhqs5EixjMhWf1pWh5X6lgXlEu/yk
DVPaHmBuZcY6i/VQXCijyxDaoTp3tmtTPgC6CeLp+KsQNczDBAz/VxjXARzXkPvW
o9U+lGct2PNc9+CIYXx55Ie19WQwZMJM9pV4BRGqiTWSPWJnTIVRfqMiU4v/NJZv
6fOHHt2twavkeEWSar11Afn4miPIfsptbxOBjmw6eVQvuT4BzyxffaQNeeJ1pM1x
61ygUBRm1/EFkYaJteTPalGi5rj2TkofAWkMiprNsWr9/gUptw7MxrQDeakr2kU7
9eRjcth+mRN+lJmmVssIQHuz33DLtt6Ds6mCXGAQxrr82dyqF/6czFWhlUhm5EBA
UEJ/Drp+Bd3kKMuGa/8uEMLdZRE7C1Kqi6QnPSZN4PEy7eML7pGia3hOPSdKBlVz
S5wQV2Fo9rR6USPXINzfiEv8QL+YRQ2G3m2/OK1hUV6wjkQiBD4ROcv8c3eOxl30
CE71DcYVSYWrjywghoAdjZtByNLwm6kFiD4k7EupttmPIQnBp276MI0bhYge5lkf
Nle+dj3wjGJVxHjTXcS6GGdU9GSox+/7agakKFyL7qD+5AzX3i4U5k6KpCXSrR2G
cO6mt4l2Oh/1ZqG7rxcZgwvnzV5dHXgdWtHkqcClOzYEE1UX1uT/eyzqs2ylOpt4
u+77/hywhOY=
=5v0K
-----END PGP SIGNATURE-----