Skip to content
OpenAdvisories
Critical ALAS2-2019-1229 12 CVEs

Critical: thunderbird security update (Amazon Linux 2)

Published Jun 11, 2019 · Updated Jun 13, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9820: 1712629: CVE-2019-9820 Mozilla: Use-after-free of ChromeEventHandler by DocShell CVE-2019-9819: 1712628: CVE-2019-9819 Mozilla: Compartment mismatch with fetch API CVE-2019-9817: 1712626: CVE-2019-9817 Mozilla: Stealing of cross-domain images using canvas CVE-2019-9800: 1712623: CVE-2019-9800 Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 CVE-2019-9797: Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66. 1712622: CVE-2019-9797 Mozilla: Cross-origin theft of images with createImageBitmap CVE-2019-7317: png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. 1672409: CVE-2019-7317 libpng: use-after-free in png_image_free in png.c CVE-2019-5798: Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. 1688200: CVE-2019-5798 chromium-browser: Out of bounds read in Skia CVE-2019-11698: 1712621: CVE-2019-11698 Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks CVE-2019-11693: 1712619: CVE-2019-11693 Mozilla: Buffer overflow in WebGL bufferdata on Linux CVE-2019-11692: 1712618: CVE-2019-11692 Mozilla: Use-after-free removing listeners in the event listener manager CVE-2019-11691: 1712617: CVE-2019-11691 Mozilla: Use-after-free in XMLHttpRequest CVE-2018-18511: Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1. 1676997: CVE-2018-18511 mozilla: Cross-origin theft of images with ImageBitmapRenderingContext

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 thunderbird 0:60.7.0-1.amzn2.0.1
Amazon Linux · 2 thunderbird-debuginfo 0:60.7.0-1.amzn2.0.1

Vulnerabilities 12

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-18511.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11691.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11692.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11693.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11698.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-5798.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-7317.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9797.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9800.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9817.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9819.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9820.html