Vulnerability in Icedove - Multiple Security Issues
Summary
DSA-2720-1: icedove - several. Affects icedove versions < 17.0.7-1~deb7u1. Fixed in 17.0.7-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Icedove is Debian's version of the Mozilla Thunderbird mail and news client. It is widely used for managing emails and news feeds. However, multiple security issues have been discovered in Icedove, including memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling, and other implementation errors. These vulnerabilities can potentially lead to the execution of arbitrary code, privilege escalation, information disclosure, or cross-site request forgery.
Vulnerability Detail
The vulnerabilities in Icedove stem from the included browser engine. They are caused by various implementation errors and can be exploited when scripting and HTML mails are enabled. The impact of these vulnerabilities can range from arbitrary code execution to unauthorized access to sensitive information. Attackers can potentially exploit these vulnerabilities to gain control over the affected system or perform malicious actions.
How To Fix
Minimum fixed version
17.0.7-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icedoveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a short-term solution, some Icedove extensions currently packaged in the Debian archive may not be compatible with the new browser engine. You can retrieve up-to-date and compatible versions of these extensions from addons.mozilla.org. Additionally, an updated and compatible version of Enigmail is included with this update.
Conclusion
Multiple security issues have been discovered in Icedove, the Debian version of Mozilla Thunderbird. These vulnerabilities can lead to various security risks, including arbitrary code execution and information disclosure. It is crucial to upgrade your Icedove packages to the latest version to mitigate these risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for icedove →
FAQ
Icedove is Debian's version of the Mozilla Thunderbird mail and news client. It is used for managing emails and news feeds.
The vulnerabilities in Icedove include memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling, and other implementation errors.
The potential consequences of these vulnerabilities include the execution of arbitrary code, privilege escalation, information disclosure, and cross-site request forgery.
To fix these vulnerabilities, it is recommended to upgrade your Icedove packages to the latest version available in the Debian repository.
As a short-term solution, you can retrieve up-to-date and compatible versions of Icedove extensions from addons.mozilla.org.
Related vulnerabilities
Recent vulnerabilities recorded for icedove.
