Information Exposure Affecting thunderbird package, versions <1:24.4.0+build1-0ubuntu0.12.04.1


Severity

Recommended
low

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.72% (82nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1204-THUNDERBIRD-419683
  • published19 Mar 2014
  • disclosed19 Mar 2014

Introduced: 19 Mar 2014

CVE-2014-1505  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade Ubuntu:12.04 thunderbird to version 1:24.4.0+build1-0ubuntu0.12.04.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Ubuntu. See How to fix? for Ubuntu:12.04 relevant fixed versions and status.

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.

CVSS Scores

version 3.1