Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5185: 1580241: CVE-2018-5185 Mozilla: Leaking plaintext through HTML forms CVE-2018-5184: 1580236: CVE-2018-5184 Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack CVE-2018-5183: 1576283: CVE-2018-5183 Mozilla: Backport critical security fixes in Skia CVE-2018-5178: 1576278: CVE-2018-5178 Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension CVE-2018-5170: 1580240: CVE-2018-5170 Mozilla: Filename spoofing for external attachments CVE-2018-5168: 1576269: CVE-2018-5168 Mozilla: Lightweight themes can be installed without user interaction CVE-2018-5162: 1580239: CVE-2018-5162 Mozilla: Encrypted mail leaks plaintext through src attribute CVE-2018-5161: 1580237: CVE-2018-5161 Mozilla: Hang via malformed headers CVE-2018-5159: 1576260: CVE-2018-5159 Mozilla: Integer overflow and out-of-bounds write in Skia CVE-2018-5155: 1576257: CVE-2018-5155 Mozilla: Use-after-free with SVG animations and text paths CVE-2018-5154: 1576255: CVE-2018-5154 Mozilla: Use-after-free with SVG animations and clip paths CVE-2018-5150: 1576250: CVE-2018-5150 Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | thunderbird | 0:52.8.0-1.amzn2 |
| Amazon Linux · 2 | thunderbird-debuginfo | 0:52.8.0-1.amzn2 |
Vulnerabilities 12
-
Unscored —
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evide…
-
Unscored —
A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This resul…
-
Unscored —
A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in …
-
Unscored —
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks…
-
Unscored —
Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Th…
-
Unscored —
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects…
-
Unscored —
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of…
-
Unscored —
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a us…
-
Unscored —
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of …
-
Unscored —
Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues incl…
-
Unscored —
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderb…
-
Unscored —
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderb…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5150.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5154.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5155.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5162.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5168.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5170.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5178.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5184.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-5185.html