漏洞类别：Ubuntu漏洞等级： 
漏洞信息
It was discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API.
Multiple memory safety issues in Thunderbird.
A heap buffer overflow during text conversion with some unicode characters.
A bad cast when processing layout with input elements in some circumstances.
A use-after-free was discovered in web animations during restyling.
A use-after-free was discovered in accessibility.
A use-after-free was discovered in web animations when destroying a timeline.
A buffer overflow was discovered when encoding image frames to images in some circumstances.
A use-after-free when changing text direction.
A use-after-free when manipulating SVG content in some circumstances.
An issue was discovered with the preloaded Public Key Pinning (HPKP).
漏洞危害
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5250)
If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5257)
If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5270)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5272)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5274)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5276)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5277)
If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5278)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5280)
If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5281)
If a man-in-the-middle (MITM) attacker was able to obtain a fraudulent certificate for a Mozilla site, they could exploit this by providing malicious addon updates. (CVE-2016-5284)
解决方案
Refer to Ubuntu advisory USN-3112-1 for affected packages and patching details, or update with your package manager.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
USN-3112-1: 14.04 (Kylin) on src (thunderbird)
USN-3112-1: 16.10 (Yakkety) on src (thunderbird)
0day
文章评论