Arch Linux Security Advisory ASA-201505-13
=========================================
Severity: Critical
Date    : 2015-05-18
CVE-ID  : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2713
CVE-2015-2716
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package thunderbird before version 31.7.0-1 is vulnerable to
multiple issues.

Resolution
=========
Upgrade to 31.7.0-1.

# pacman -Syu "thunderbird>=31.7.0-1"

The problem has been fixed upstream in version 31.7.0.

Workaround
=========
CVE-2015-2708, CVE-2015-2709, CVE-2015-2710 and CVE-2015-2716 cannot be
exploited through email in the Thunderbird product because scripting is
disabled, but are potentially a risk in browser or browser-like contexts.

There is no workaround for CVE-2015-2713.

Description
==========
- CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and
Firefox 38):

Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported
memory safety problems and crashes that affect Firefox ESR 31.6 and
Firefox 37.

- CVE-2015-2709 (Memory safety bugs fixed in Firefox 38):

Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats
Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety
problems and crashes that affect Firefox 37.

- CVE-2015-2710 (Buffer overflow with SVG content and CSS):

Using the Address Sanitizer tool, security researcher Atte Kettunen
found a buffer overflow during the rendering of SVG format graphics when
combined with specific CSS properties on a page. This results in a
potentially exploitable crash.

- CVE-2015-2713 (Use-after-free during text processing with vertical
text enabled):

Security researcher Scott Bell used the Address Sanitizer tool to
discover a use-after-free error during the processing of text when
vertical text is enabled. This leads to a potentially exploitable crash.

- CVE-2015-2716 (Buffer overflow when parsing compressed XML):

Security researcher Ucha Gobejishvili used the Address Sanitizer tool to
find a buffer overflow while parsing compressed XML content. This was
due to an error in how buffer space is created and modified when
handling large amounts of XML data. This results in a potentially
exploitable crash.


Impact
=====
A remote attacker can execute arbitrary code with the privileges of the
current user.

References
=========
https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716