Red Hat Security AdvisoryRHSA-2018:3458
thunderbird security update
Released 2018-11-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) thunderbird-60.2.1-4.el7_5
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-60.2.1-4.el7_5
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-60.2.1-4.el7_5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-60.2.1-4.el7_5
Fixes 8 records
Priority MEDIUM 48
A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03357 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-416
Priority MEDIUM 48
A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03357 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-416
Priority MEDIUM 48
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03146 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-119
Priority LOW 35
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03662 · Published 2017-11-04 · Fixed CWE-200
Priority LOW 34
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00393 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-787
Priority LOW 31
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries().
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01093 · Published 2019-02-28 · Partial fix · 62, 60.2 +1 CWE-346
Priority LOW 31
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory.
CVSS 3.0HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00358 · Published 2018-10-18 · Fixed in 60.2.1, 62.0.2 CWE-20
Priority LOW 25
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible.
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0046 · Published 2018-10-18 · Partial fix · 62, 60.2.1 CWE-522
THREATIST.IORead the docs