Secunia

Some vulnerabilities have been reported in Thunderbird, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, trick users into executing arbitrary programs, and potentially compromise a user's system.

1) An error caused due to attachments not being displayed correctly in mails can be exploited to spoof the file extension and the associated file type icon via a combination of overly long filenames containing whitespaces and "Content-Type" headers not matching the file extension.

Successful exploitation may lead to malware being saved to e.g. the desktop.

NOTE: Attachments can be saved by dragging the attachment, or using the "Save As..." or "Save All..." functionality. For files on the desktop, the icon can be spoofed if it e.g. is a ".exe" or ".lnk" file.

The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and 1.0.7. Other versions may also be affected. Only the Microsoft Windows platform is affected.

2) Scripts in e-mails can be executed even when JavaScript has been disabled (JavaScript is disabled by default). This can be exploited when a user edits a HTML mail message (e.g. when replying) with a JavaScript URI handler in the "src" attribute of an "iframe" tag. This does not pose any direct security risks by itself, but may enable exploitation of vulnerabilities requiring JavaScript.

The vulnerability has been confirmed in version 1.0.7 and has also been reported in prior versions.

3) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code, but requires that JavaScript is enabled (not default setting).

4) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.

Successful exploitation requires that JavaScript is enabled (not default setting).

5) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.

Successful exploitation requires that JavaScript is enabled (not default setting).

6) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.

Successful exploitation requires that JavaScript is enabled (not default setting).

7) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.

Successful exploitation requires that JavaScript is enabled (not default setting).

8) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.

Successful exploitation requires that JavaScript is enabled (not default setting).

9) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).

10) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).

11) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.

Successful exploitation requires that JavaScript is enabled (not default setting).

12) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.

Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).

13) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

Successful exploitation requires that JavaScript is enabled (not default setting).

Solution
Update to version 1.5.
Further details available in Customer Area

Provided and/or discovered by
1) Andreas Sandblad, Secunia Research
2) nono2357, sysdream
3) Igor Bukanov
4) Bernd Mielke
5) Alden D'Souza
6) Martijn Wargers
7) Bob Clary
8, 9, 11) shutdown
10, 13) moz_bug_r_a4
12) TippingPoint and the Zero Day Initiative

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2005-22/advisory/

Mozilla:
http://www.mozilla.org/security/announce/2006/mfsa2006-10.html
http://www.mozilla.org/security/announce/2006/mfsa2006-11.html
http://www.mozilla.org/security/announce/2006/mfsa2006-14.html
http://www.mozilla.org/security/announce/2006/mfsa2006-15.html
http://www.mozilla.org/security/announce/2006/mfsa2006-16.html
http://www.mozilla.org/security/announce/2006/mfsa2006-17.html
http://www.mozilla.org/security/announce/2006/mfsa2006-18.html
http://www.mozilla.org/security/announce/2006/mfsa2006-19.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area