Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code, denial of service or spoofing of S/MIME signatures.

For Debian 8 'Jessie', these problems have been fixed in version 1:60.5.1-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0269 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.5.0.

    Security Fix(es):

    * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

    * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

    * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

    * libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv     Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian     Holler, and Jed Davis as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

  - Mozilla: Use-after-free parsing HTML5 stream     (CVE-2018-18500)

  - Mozilla: Memory safety bugs fixed in Firefox 65 and     Firefox ESR 60.5 (CVE-2018-18501)

  - Mozilla: Privilege escalation through IPC channel     messages (CVE-2018-18505)

  - libical: Multiple use-after-free vulnerabilities     (CVE-2016-5824)

This update for MozillaFirefox, mozilla-nss fixes the following issues :

Security issues fixed :

CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (bsc#1122983).

CVE-2018-18501: Fixed multiple memory safety bugs (bsc#1122983).

CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (bsc#1122983).

CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069).

Non-security issue fixed: Update to MozillaFirefox ESR 60.5.0

Update to mozilla-nss 3.41.1

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

This update for MozillaThunderbird to version 60.5.0 fixes the following issues :

Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31) :

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824: DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bugs fixed and changes made :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     inferface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and     earlier contained a fault that potentially deleted saved     passwords and private certificate keys for users using a     master password. Version 60.3.3 will prevent the loss of     data; affected users who have already upgraded to     version 60.3.2 or earlier can restore the deleted     key3.db file from backup to complete the migration.

  - Address book search and auto-complete slowness     introduced in Thunderbird 60.3.2

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixe Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3897-1 advisory.

    A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS     calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted message, an attacker could potentially exploit these to cause a denial of service, or execute     arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501,     CVE-2018-18505)

    An issue was discovered with S/MIME signature verification in some circumstances. An attacker could     potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird to version 60.5.1 fixes the following issues :

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330) :

  - CVE-2018-18356: Fixed a Use-after-free in Skia.

  - CVE-2019-5785: Fixed an Integer overflow in Skia.

  - CVE-2018-18335: Fixed a Buffer overflow in Skia by     default deactivating Canvas 2D. This issue does not     affect Linuc distributions.

  - CVE-2018-18509: Fixed a flaw which during verification     of certain S/MIME signatures showing mistekenly that     emails bring a valid sugnature. 

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824 DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bug fixes and changes :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     interface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db).

  - Address book search and auto-complete slowness

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixed Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-201903-04 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page possibly resulting in the execution of arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of Firefox installed on the remote Windows host is prior to 65.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-01 advisory.

  - Mozilla developers and community members Arthur Iakab, Christoph Diehl, Christian Holler, Kalel, Emilio     Cobos lvarez, Cristina Coroiu, Noemi Erli, Natalia Csoregi, Julian Seward, Gary Kwong, Tyson Smith,     Yaron Tausky, and Ronald Crane reported memory safety bugs present in Firefox 64. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort that some of these could be     exploited to run arbitrary code. (CVE-2018-18502)

  - An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication     to communication between IPC endpoints and server parents during IPC process creation. This authentication     is insufficient for channels created after the IPC process is started, leading to the authentication not     being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due     to lack of message validation in the listener process. (CVE-2018-18505)

  - A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML     elements. This results in the stream parser object being freed while still in use, leading to a     potentially exploitable crash. (CVE-2018-18500)

  - A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in     use during graphic operations. This results in a potentially exploitable crash and the possibility of     reading from the memory of the freed buffers. (CVE-2018-18504)

  - When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may     occur because of a compartment mismatch in some situations. (CVE-2018-18503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML     elements. This results in the stream parser object being freed while still in use, leading to a     potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and     Firefox < 65. (CVE-2018-18500)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122263	Debian DLA-1678-1 : thunderbird security update	Nessus	Debian Local Security Checks	2019/2/19	2024/6/20	critical
121585	RHEL 6 : thunderbird (RHSA-2019:0269)	Nessus	Red Hat Local Security Checks	2019/2/5	2024/11/7	critical
121607	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190204)	Nessus	Scientific Linux Local Security Checks	2019/2/6	2024/6/24	critical
121638	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:0273-1)	Nessus	SuSE Local Security Checks	2019/2/7	2024/6/24	critical
122065	CentOS 7 : thunderbird (CESA-2019:0270)	Nessus	CentOS Local Security Checks	2019/2/11	2024/6/21	critical
122224	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-182)	Nessus	SuSE Local Security Checks	2019/2/15	2024/6/20	critical
122482	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Thunderbird vulnerabilities (USN-3897-1)	Nessus	Ubuntu Local Security Checks	2019/2/27	2024/8/27	critical
122493	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-251)	Nessus	SuSE Local Security Checks	2019/2/28	2024/6/18	critical
122732	GLSA-201903-04 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
121512	Mozilla Firefox < 65.0	Nessus	Windows	2019/1/31	2025/11/18	critical
247599	Linux Distros Unpatched Vulnerability : CVE-2018-18500	Nessus	Misc.	2025/8/10	2026/7/24	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical