Red Hat Security AdvisoryRHSA-2018:0262
thunderbird security update
Released 2018-02-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) thunderbird-52.6.0-1.el7_4
- Red Hat Enterprise Linux Desktop (v. 6) thunderbird-52.6.0-1.el6_9
- Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-52.6.0-1.el6_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-52.6.0-1.el7_4
- Red Hat Enterprise Linux Workstation (v. 6) thunderbird-52.6.0-1.el6_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-52.6.0-1.el7_4
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-52.6.0-1.el7_4
Fixes 10 records
Priority MEDIUM 52
A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07028 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 52
A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06926 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 52
A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07028 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 49
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04127 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-190
Priority MEDIUM 48
A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0301 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 48
Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03335 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-119
Priority MEDIUM 47
A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02966 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 47
A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are us…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02966 · Published 2018-06-11 · Fixed in 52.6, 58 CWE-416
Priority MEDIUM 47
A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02853 · Published 2018-06-11 · Fixed in 52.6 CWE-416
Priority LOW 29
If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02338 · Published 2018-06-11 · Fixed in 52.6, 58
THREATIST.IORead the docs