Mozilla Zaps Thunderbird Security Bugs

Updates to the open-source mail client correct a serious URL parsing vulnerability affecting Linux users.

The Mozilla Foundation on Friday shipped a new version of its Thunderbird mail client to plug a potentially serious URL parsing security hole affecting Linux users.

The open-source group described Thunderbird 1.0.7 as a "security and stability update" that provides a comprehensive fix for the URL parsing bug that was also flagged in the Firefox browser.

That flaw, which affects Thunderbird users on Linux, has already been fixed in Firefox 1.0.7 and the Mozilla Suite 1.7.12. It could allow a malicious URL to execute shell commands with the privileges of the logged-on user.

The Foundation has earlier suggested that users avoid clicking on links in spam or other e-mails.

Read details here about Mozillas overhaul of Thunderbirds calendar.

Security alerts aggregator Secunia Inc. rates the flaw as "highly critical."

Resource Library:

"We recommend that all users upgrade to this latest version," the Foundation said.

Thunderbird is a full-featured e-mail, RSS and newsgroup client and is being marketed as the volunteer Foundations answer to Microsoft Corp.s Outlook.

Click here to read about Plaxos contact manager for Thunderbird e-mail.

Mozilla is also beta testing Thunderbird 1.5, but the security fixes have not yet been added to that update.

Thunderbird 1.5 Beta 1 promises an automated mechanism to streamline product upgrades; a built-in phishing detector to thwart e-mail scammers; Podcasting and RSS improvements; integration with server-side spam filtering, Kerberos authentication and several stability improvements.

Check out eWEEK.coms for the latest open-source news, reviews and analysis.

Reader Comments: Mozilla Zaps Thunderbird Security Bugs >>> Be the FIRST to comment on this article!

>>> More Linux & Open Source Articles          >>> More By Ryan Naraine