Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11708: 1722673: CVE-2019-11708 Mozilla: Sandbox escape using Prompt:Open CVE-2019-11707: 1721789: CVE-2019-11707 Mozilla: Type confusion in Array.pop CVE-2019-11706: 1720011: CVE-2019-11706 libical: Type confusion in icaltimezone_get_vtimezone_properties function in icalproperty.c CVE-2019-11705: 1720008: CVE-2019-11705 libical: Stack buffer overflow in icalrecur_add_bydayrules in icalrecur.c CVE-2019-11704: 1720006: CVE-2019-11704 libical: Heap buffer overflow in icalmemory_strdup_and_dequote function in icalvalue.c CVE-2019-11703: 1720001: CVE-2019-11703 libical: Heap buffer over read in icalparser.c parser_get_next_char
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | thunderbird | 0:60.7.2-2.amzn2.0.1 |
| Amazon Linux · 2 | thunderbird-debuginfo | 0:60.7.2-2.amzn2.0.1 |
Vulnerabilities 6
-
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022 -
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when proc…
-
Unscored —CVE-2019-11705 Public exploit
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…
-
Unscored —CVE-2019-11706 Public exploit
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11703.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11704.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11705.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11706.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11708.html