A memory corruption flaw exists in Mozilla Firefox, Thunderbird and SeaMonkey. The programs fail to sanitize certain unspecified user-supplied input, resulting in memory corruption. Through unspecified vectors, a context-dependent attacker can execute arbitrary code.

Upgrade to Firefox to version 3.6.17 or 3.5.19 or higher, Thunderbird to 3.1.10 or higher and SeaMonkey to 2.0.14 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• OVAL ID: 14038
• CVE ID: 2011-0072 (see also: NVD)
• Secunia Advisory ID: 44357 44368 44386 44398 44399 44401 44404 44407 44422 44428 44430 44450 44455 44472 44486 44528 44541 46035 51766
• Related OSVDB ID: 72074 72075 72076 72077 72078 72080 72081 72082 72083
• Vendor Specific Advisory URL: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird
  http://www.mozilla.org/security/announce/2011/mfsa2011-12.html
  http://www.mozilla.org/security/announce/2011/mfsa2011-16.html
  http://www.ubuntu.com/usn/usn-1112-1/
  http://www.ubuntu.com/usn/usn-1123-1/
• Vendor Specific News/Changelog Entry: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird
  http://lists.debian.org/debian-security-announce/2011/msg00096.html
  http://lists.debian.org/debian-security-announce/2011/msg00097.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059185.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059187.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059189.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059704.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059709.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059710.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059975.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059996.html
  http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00001.html
  http://lists.opensuse.org/opensuse-updates/2011-05/msg00005.html
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
  http://www.mozillamessaging.com/en-US/thunderbird/3.1.10/releasenotes/
  https://bugzilla.mozilla.org/show_bug.cgi?id=624187 [ Auth Req'd ]
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-May/001325.html
  https://qa.mandriva.com/59951
• RedHat RHSA: http://rhn.redhat.com/errata/RHSA-2011-0471.html
  https://rhn.redhat.com/errata/RHSA-2011-0473.html
• Mail List Post: http://seclists.org/bugtraq/2011/May/0
  http://seclists.org/fulldisclosure/2011/May/3
• Other Advisory URL: http://www.debian.org/security/2011/dsa-2227
  http://www.debian.org/security/2011/dsa-2228
  http://www.debian.org/security/2011/dsa-2235
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:079
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:080

• Martin Barbella