Red Hat Security Advisory

RHSA-2018:0061

thunderbird security update

Released 2018-01-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) thunderbird-52.5.2-1.el7_4
Red Hat Enterprise Linux Desktop (v. 6) thunderbird-52.5.2-1.el6_9
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-52.5.2-1.el6_9
Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-52.5.2-1.el7_4
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-52.5.2-1.el6_9
Red Hat Enterprise Linux Workstation (v. 7) thunderbird-52.5.2-1.el7_4
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-52.5.2-1.el7_4

TI-2017-05462 CVE-2017-7846 · GHSA-2529-rwp4-75f6

MEDIUM 42

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01943 Published 2018-06-11 Fixed in 52.5.2 CWE-74

TI-2017-05464 CVE-2017-7848 · GHSA-fpgh-654r-2xjr

LOW 28

RSS fields can inject new lines into the created email structure, modifying the message body.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01728 Published 2018-06-11 Fixed in 52.5.2 CWE-74

TI-2017-05446 CVE-2017-7829 · GHSA-hpvr-62fv-x7x4

LOW 28

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01765 Published 2018-06-11 Fixed in 52.5.2 CWE-20

TI-2017-05463 CVE-2017-7847 · GHSA-jmgx-hhrr-ppmv

LOW 23

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01594 Published 2018-06-11 Fixed in 52.5.2 CWE-200