Red Hat Security AdvisoryRHSA-2019:1626
thunderbird security update
Released 2019-06-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) thunderbird-60.7.2-2.el7_6
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-60.7.2-2.el7_6
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-60.7.2-2.el7_6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-60.7.2-2.el7_6
Fixes 6 records
Priority CRITICAL 100KEV
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.55874 · Published 2019-07-23 · Fixed in 60.7.2, 67.0.4 CWE-20
Priority CRITICAL 97KEV
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.37951 · Published 2019-07-23 · Fixed in 60.7.1, 67.0.3 +1 CWE-843
Priority MEDIUM 55
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10527 · Published 2019-07-23 · Partial fix · 60.7.1 CWE-787
Priority MEDIUM 55
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10527 · Published 2019-07-23 · Partial fix · 60.7.1 CWE-787
Priority MEDIUM 54
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09903 · Published 2019-07-23 · Partial fix · 60.7.1 CWE-787
Priority MEDIUM 45
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.09731 · Published 2019-07-23 · Fixed in 60.7.1 CWE-843
THREATIST.IORead the docs