Red Hat Security Advisory

RHSA-2019:0269

thunderbird security update

Released 2019-02-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) thunderbird-60.5.0-1.el6_10
Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-60.5.0-1.el6_10
Red Hat Enterprise Linux Workstation (v. 6) thunderbird-60.5.0-1.el6_10

Fixes 4 records

TI-2018-13084 CVE-2018-18500 · GHSA-6hxm-h9g7-cg3m

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with…

MEDIUM 56

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.12658 Published 2019-02-05 Fixed CWE-416

TI-2018-13089 CVE-2018-18505 · GHSA-5g4g-56fq-mvwf

Improper authentication in Mozilla Thunderbird

MEDIUM 50

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation.

CVSS 3.0CRITICAL 10.0 Network No auth No interaction EPSS 0.04416 Published 2019-02-05 Fixed in 60.5, 65 CWE-287

TI-2018-13085 CVE-2018-18501 · GHSA-4hxm-f92j-36cq

Memory corruption in Mozilla Thunderbird

MEDIUM 48

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03372 Published 2019-02-05 Fixed in 60.5, 65 CWE-119

TI-2016-05052 CVE-2016-5824 · GHSA-w3h4-vpfj-x3xq

libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.

LOW 29

libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.02171 Published 2017-01-27 Partial fix CWE-416