Red Hat Security AdvisoryRHSA-2018:1725
thunderbird security update
Released 2018-05-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) thunderbird-52.8.0-1.el7_5
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-52.8.0-1.el7_5
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-52.8.0-1.el7_5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-52.8.0-1.el7_5
Fixes 12 records
Priority MEDIUM 61
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20641 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-190
Priority MEDIUM 48
Mozilla developers backported selected changes in the Skia library.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03172 · Published 2018-06-11 · Fixed in 52.8 CWE-119
Priority MEDIUM 48
A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03379 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-416
Priority MEDIUM 48
A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03194 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-416
Priority MEDIUM 48
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03086 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-119
Priority MEDIUM 43
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.04893 · Published 2018-06-11 · Fixed in 52.8 CWE-119
Priority LOW 37
Plaintext of decrypted emails can leak through the src attribute of remote images, or links.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01915 · Published 2018-06-11 · Fixed in 52.8 CWE-311
Priority LOW 36
Using remote content in encrypted messages can lead to the disclosure of plaintext.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01739 · Published 2018-06-11 · Fixed in 52.8 CWE-326
Priority LOW 32
Plaintext of decrypted emails can leak through by user submitting an embedded form.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01506 · Published 2018-06-11 · Fixed in 52.8 CWE-311
Priority LOW 29
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02332 · Published 2018-06-11 · Fixed in 52.8, 60
Priority LOW 24
Crafted message headers can cause a Thunderbird process to hang on receiving the message.
CVSS 3.0MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.01979 · Published 2018-06-11 · Fixed in 52.8 CWE-20
Priority LOW 23
It is possible to spoof the filename of an attachment and display an arbitrary attachment name.
CVSS 3.0MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.01697 · Published 2018-06-11 · Fixed in 52.8 CWE-20
THREATIST.IORead the docs