Red Hat Security Advisory

RHSA-2020:2616

thunderbird security update

Released 2020-06-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v. 8.0) thunderbird-68.9.0-1.el8_0

Fixes 4 records

TI-2020-09928 CVE-2020-12410 · GHSA-rc5h-67pm-gm2w

Out-of-bounds write in Mozilla Thunderbird

MEDIUM 42

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01729 Published 2020-07-09 Partial fix · 68.9.0, 77 +1 CWE-787

TI-2020-09924 CVE-2020-12406 · GHSA-cf83-h775-f5f6

Insufficient verification of data authenticity in Mozilla Thunderbird

MEDIUM 40

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0102 Published 2020-07-09 Partial fix · 68.9.0, 77 +1 CWE-345

TI-2020-09916 CVE-2020-12398 · GHSA-jvxv-vphc-73rg

Cleartext transmission of sensitive information in Mozilla Thunderbird

LOW 35

If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00976 Published 2020-07-09 Partial fix · 68.9.0 CWE-319

TI-2020-09923 CVE-2020-12405 · GHSA-7768-mfm4-9cmv

Race condition in Mozilla Thunderbird

LOW 27

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.01352 Published 2020-07-09 Partial fix · 68.9.0, 77 +1 CWE-362