Red Hat Security Advisory: thunderbird security update

Fixed packages 6

Vulnerabilities 11

• Unscored —
  CVE-2018-12359

  A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dy…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12360

  A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by fo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12362

  An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) s…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12363

  A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resultin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12364

  NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin P…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12365

  A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12366

  An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12372

  Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12373

  dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forw…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12374

  Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text …

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-5188

  Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of m…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595028
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595029
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595031
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1598529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1598538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1598543
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2252.json
• report
  https://access.redhat.com/security/cve/CVE-2018-5188
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5188
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5188
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-5188
• report
  https://access.redhat.com/security/cve/CVE-2018-12359
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12359
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12359
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12359
• report
  https://access.redhat.com/security/cve/CVE-2018-12360
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12360
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12360
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12360
• report
  https://access.redhat.com/security/cve/CVE-2018-12362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12362
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12362
• report
  https://access.redhat.com/security/cve/CVE-2018-12363
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12363
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12363
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12363
• report
  https://access.redhat.com/security/cve/CVE-2018-12364
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12364
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12364
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12364
• report
  https://access.redhat.com/security/cve/CVE-2018-12365