Red Hat Security Advisory: thunderbird security update

Fixed packages 16

Vulnerabilities 8

• Unscored —
  CVE-2017-5373

  Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory cor…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5375 Public exploit EPSS 34%

  JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5376

  Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 4…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5378

  Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5380

  A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5383

  URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, all…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5390

  The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018
• Unscored —
  CVE-2017-5396

  A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-03/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1415924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416272
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416280
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416281
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0238.json
• report
  https://access.redhat.com/security/cve/CVE-2017-5373
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5373
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5373
• article
  https://www.mozilla.org/security/announce/2017/mfsa2016-01/#CVE-2017-5373
• report
  https://access.redhat.com/security/cve/CVE-2017-5375
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5375
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5375
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5375
• report
  https://access.redhat.com/security/cve/CVE-2017-5376
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5376
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5376
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5376
• report
  https://access.redhat.com/security/cve/CVE-2017-5378
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5378
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5378
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5378
• report
  https://access.redhat.com/security/cve/CVE-2017-5380
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5380
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5380
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5380
• report
  https://access.redhat.com/security/cve/CVE-2017-5383
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5383
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5383
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5383
• report
  https://access.redhat.com/security/cve/CVE-2017-5390
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5390
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5390
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5390