Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1477)

Cody Crews discovered a method to bypass System Only Wrappers. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential data or execute code with the privileges of the user invoking Thunderbird. (CVE-2014-1479)

Fredrik Lonnqvist discovered a use-after-free in Thunderbird. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the priviliges of the user invoking Thunderbird.
(CVE-2014-1482)

Arthur Gerkis discovered a use-after-free in Thunderbird. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the priviliges of the user invoking Thunderbird.
(CVE-2014-1486)

Masato Kinugawa discovered a cross-origin information leak in web worker error messages. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information.
(CVE-2014-1487)

Several issues were discovered with ticket handling in NSS. An attacker could potentially exploit these to cause a denial of service or bypass cryptographic protection mechanisms. (CVE-2014-1490, CVE-2014-1491)

Boris Zbarsky discovered that security restrictions on window objects could be bypassed under certain circumstances. (CVE-2014-1481)

Fabian Cuchietti and Ateeq ur Rehman Khan discovered that it was possible to bypass JavaScript execution restrictions when replying to or forwarding mail messages in certain circumstances. An attacker could potentially exploit this to steal confidential information or modify message content. (CVE-2013-6674).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content.
Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Thunderbird rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross site-scripting (XSS) attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5614)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.2.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.2.0 ESR, which corrects these issues.
After installing the update, Thunderbird must be restarted for the changes to take effect.

The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities:

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution. Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

The installed version of Thunderbird is a version prior to 24.0.
It is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution.  Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

Versions of SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)
 - Stored cross-site scripting vulnerability due to insufficient input validation of 'data:' URLs in iframe elements. (CVE-2013-6674)

The installed version of SeaMonkey is a version prior to 2.20. It is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

ID	Name	Product	Family	Severity
72599	Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2119-1)	Nessus	Ubuntu Local Security Checks	critical
71370	RHEL 5 / 6 : thunderbird (RHSA-2013:1823)	Nessus	Red Hat Local Security Checks	critical
71357	CentOS 5 / 6 : thunderbird (CESA-2013:1823)	Nessus	CentOS Local Security Checks	critical
69995	Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities	Nessus	Windows	critical
69991	Thunderbird 17.x through 23.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
6977	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
69272	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2013-6674

medium

Tenable Plugins

critical

critical

critical

critical

critical

high

critical