Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 12

• Unscored —
  CVE-2018-5150

  Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evide…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5154

  A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This resul…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5155

  A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5159 Public exploit EPSS 21%

  An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5161

  Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Th…

  Mozilla Thunderbird Thunderbird ESR thunderbird Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5162

  Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects…

  Mozilla Thunderbird Thunderbird ESR thunderbird Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5168

  Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5170

  It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a us…

  Mozilla Thunderbird Thunderbird ESR thunderbird Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5178

  A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of …

  Mozilla Thunderbird Firefox ESR Thunderbird ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5183

  Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues incl…

  Mozilla Thunderbird Firefox ESR Thunderbird ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5184

  Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderb…

  Mozilla Thunderbird Thunderbird ESR thunderbird Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5185

  Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderb…

  Mozilla Thunderbird Thunderbird ESR thunderbird Debian Ubuntu
  Jun 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576255
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576283
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1580236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1580237
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1580239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1580240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1580241
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1726.json
• report
  https://access.redhat.com/security/cve/CVE-2018-5150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5150
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5150
• report
  https://access.redhat.com/security/cve/CVE-2018-5154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5154
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5154
• report
  https://access.redhat.com/security/cve/CVE-2018-5155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5155
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5155
• report
  https://access.redhat.com/security/cve/CVE-2018-5159
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5159
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5159
• report
  https://access.redhat.com/security/cve/CVE-2018-5161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5161
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161
• report
  https://access.redhat.com/security/cve/CVE-2018-5162
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5162
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5162
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162
• report
  https://access.redhat.com/security/cve/CVE-2018-5168