Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 6

• Critical 10.0
  CVE-2019-11708 Exploited Public exploit EPSS 56%

  Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2019-11707 Exploited Public exploit EPSS 38%

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• Unscored —
  CVE-2019-11703 Public exploit EPSS 11%

  A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 23, 2019
• Unscored —
  CVE-2019-11704 Public exploit EPSS 11%

  A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when proc…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 23, 2019
• Unscored —
  CVE-2019-11705 Public exploit

  A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 23, 2019
• Unscored —
  CVE-2019-11706 Public exploit

  A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 23, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720008
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720011
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1721789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1722673
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1623.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11703
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11703
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11703
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/
• report
  https://access.redhat.com/security/cve/CVE-2019-11704
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11704
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11704
• article
  https://www.x41-dsec.de/lab/advisories/x41-2019-001-thunderbird/
• report
  https://access.redhat.com/security/cve/CVE-2019-11705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11705
• report
  https://access.redhat.com/security/cve/CVE-2019-11706
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11706
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11706
• report
  https://access.redhat.com/security/cve/CVE-2019-11707
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11707
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11707
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/#CVE-2019-11707
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2019-11708
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11708
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11708
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/#CVE-2019-11708