Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code, denial of service or spoofing of S/MIME signatures.

For Debian 8 'Jessie', these problems have been fixed in version 1:60.5.1-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0269 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.5.0.

    Security Fix(es):

    * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

    * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

    * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

    * libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv     Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian     Holler, and Jed Davis as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

  - Mozilla: Use-after-free parsing HTML5 stream     (CVE-2018-18500)

  - Mozilla: Memory safety bugs fixed in Firefox 65 and     Firefox ESR 60.5 (CVE-2018-18501)

  - Mozilla: Privilege escalation through IPC channel     messages (CVE-2018-18505)

  - libical: Multiple use-after-free vulnerabilities     (CVE-2016-5824)

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

This update for MozillaThunderbird to version 60.5.0 fixes the following issues :

Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31) :

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824: DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bugs fixed and changes made :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     inferface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and     earlier contained a fault that potentially deleted saved     passwords and private certificate keys for users using a     master password. Version 60.3.3 will prevent the loss of     data; affected users who have already upgraded to     version 60.3.2 or earlier can restore the deleted     key3.db file from backup to complete the migration.

  - Address book search and auto-complete slowness     introduced in Thunderbird 60.3.2

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixe Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3897-1 advisory.

    A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS     calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted message, an attacker could potentially exploit these to cause a denial of service, or execute     arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501,     CVE-2018-18505)

    An issue was discovered with S/MIME signature verification in some circumstances. An attacker could     potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird to version 60.5.1 fixes the following issues :

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330) :

  - CVE-2018-18356: Fixed a Use-after-free in Skia.

  - CVE-2019-5785: Fixed an Integer overflow in Skia.

  - CVE-2018-18335: Fixed a Buffer overflow in Skia by     default deactivating Canvas 2D. This issue does not     affect Linuc distributions.

  - CVE-2018-18509: Fixed a flaw which during verification     of certain S/MIME signatures showing mistekenly that     emails bring a valid sugnature. 

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824 DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bug fixes and changes :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     interface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db).

  - Address book search and auto-complete slowness

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixed Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-201903-04 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page possibly resulting in the execution of arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122263	Debian DLA-1678-1 : thunderbird security update	Nessus	Debian Local Security Checks	2019/2/19	2024/6/20	critical
121585	RHEL 6 : thunderbird (RHSA-2019:0269)	Nessus	Red Hat Local Security Checks	2019/2/5	2024/11/7	critical
121607	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190204)	Nessus	Scientific Linux Local Security Checks	2019/2/6	2024/6/24	critical
122065	CentOS 7 : thunderbird (CESA-2019:0270)	Nessus	CentOS Local Security Checks	2019/2/11	2024/6/21	critical
122224	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-182)	Nessus	SuSE Local Security Checks	2019/2/15	2024/6/20	critical
122482	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Thunderbird vulnerabilities (USN-3897-1)	Nessus	Ubuntu Local Security Checks	2019/2/27	2024/8/27	critical
122493	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-251)	Nessus	SuSE Local Security Checks	2019/2/28	2024/6/18	critical
122732	GLSA-201903-04 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
122064	CentOS 6 : thunderbird (CESA-2019:0269)	Nessus	CentOS Local Security Checks	2019/2/11	2024/6/21	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical