thunderbird-52.5.0-1.AXS4

エラータID: AXSA:2017-2439:07

Release date: 
Tuesday, December 5, 2017 - 14:37
Subject: 
thunderbird-52.5.0-1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 52.5.0.

Security Fix(es):

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)

Asianux would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, David Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer, Philipp, Nicholas Nethercote, Oriol Brufau, André Bargull, Bob Clary, Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, Ryan VanderMeulen, Nils, and Jun Kokatsu as the original reporters.

CVE-2017-7826
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2017-7828
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2017-7830
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.

Solution: 

Update packages.

CVEs: 
CVE-2017-7826
Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
CVE-2017-7828
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
CVE-2017-7830
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
Additional Info: 

N/A

Download: 

SRPMS
  1. thunderbird-52.5.0-1.AXS4.src.rpm
    MD5: cabdb0e4b18697f0ed73887d08535148
    SHA-256: 908c2f595d0a1e0e94beb73e6511925bf1aa42e78a4475a93f575da34088f51e
    Size: 400.37 MB

Asianux Server 4 for x86
  1. thunderbird-52.5.0-1.AXS4.i686.rpm
    MD5: 1639fe2810edccfed6a4b4314facb9b6
    SHA-256: 9ac4ef4bd2c23d3531cccfe2556200477d00bb7ebab5e04b6e84cad0da402729
    Size: 72.85 MB

Asianux Server 4 for x86_64
  1. thunderbird-52.5.0-1.AXS4.x86_64.rpm
    MD5: 3a9ad7cc562b96516a038ebbfd9117d1
    SHA-256: ede995555941198d252564dd504d596362e335ab29ea6ec527218edaa69ce077
    Size: 72.29 MB