Multiple Security Issues in Icedove
Summary
DSA-2746-1: icedove - several. Affects icedove versions < 17.0.8-1~deb7u1. Fixed in 17.0.8-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Icedove is Debian's version of the Mozilla Thunderbird mail and news client. It is an open-source email client that provides various features for managing emails, news feeds, and chat accounts. Icedove is widely used by Debian users for its robustness and flexibility. However, several security issues have been identified in Icedove that could potentially lead to the execution of arbitrary code or cross-site scripting attacks.
Vulnerability Detail
The vulnerabilities in Icedove include multiple memory safety errors, missing permission checks, and other implementation errors. These issues primarily stem from the included browser engine and are only exploitable if scripting and HTML mails are enabled. The specific vulnerabilities identified are:
- CVE-2013-1701: Memory corruption vulnerability
- CVE-2013-1709: Use-after-free vulnerability
- CVE-2013-1710: Buffer overflow vulnerability
- CVE-2013-1713: Cross-site scripting vulnerability
- CVE-2013-1714: Privilege escalation vulnerability
- CVE-2013-1717: Memory corruption vulnerability
These vulnerabilities could allow attackers to execute arbitrary code on the affected system or conduct cross-site scripting attacks, potentially leading to unauthorized access, data theft, or system compromise.
How To Fix
Minimum fixed version
17.0.8-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icedoveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Icedove is not immediately possible, you can mitigate the risk by disabling scripting and HTML mails in the application settings. This will prevent the exploitation of the identified vulnerabilities. However, it is strongly advised to upgrade to the fixed versions as soon as possible.
Conclusion
Multiple security issues have been identified in Icedove, the Debian version of Mozilla Thunderbird. These vulnerabilities can lead to the execution of arbitrary code or cross-site scripting attacks. It is crucial to upgrade to the fixed versions (17.0.8-1~deb7u1 for wheezy and 17.0.8-1 for sid) or disable scripting and HTML mails as a temporary measure. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for icedove →
FAQ
Icedove is Debian's version of the Mozilla Thunderbird mail and news client. It provides a feature-rich email client with support for managing emails, news feeds, and chat accounts.
These vulnerabilities can be exploited by crafting malicious emails or websites that trigger the identified memory safety errors, permission checks, or implementation errors. When a user with scripting and HTML mails enabled interacts with the malicious content, arbitrary code can be executed or cross-site scripting attacks can occur.
No, the vulnerabilities primarily stem from the included browser engine and are only exploitable if scripting and HTML mails are enabled. If these features are disabled, the risk of exploitation is significantly reduced.
Yes, if upgrading Icedove is not immediately possible, you can mitigate the risk by disabling scripting and HTML mails in the application settings. This will prevent the exploitation of the identified vulnerabilities. However, it is strongly advised to upgrade to the fixed versions as soon as possible.
You can obtain the fixed versions of Icedove from the official Debian repositories or through the package manager of your Debian-based system. Ensure that you update to version 17.0.8-1~deb7u1 for the stable distribution (wheezy) and version 17.0.8-1 for the unstable distribution (sid).
Related vulnerabilities
Recent vulnerabilities recorded for icedove.
