Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 6

• Unscored —
  CVE-2020-12417

  Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memor…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12418

  Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malici…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12419

  When processing callbacks that occurred during window flushing in the parent process, the associated window may die; ca…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12420

  When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to m…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12421

  When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were l…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-15646

  If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Oct 8, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-26/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1853018
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3038.json
• report
  https://access.redhat.com/security/cve/CVE-2020-12417
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12417
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12417
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-25/#CVE-2020-12417
• report
  https://access.redhat.com/security/cve/CVE-2020-12418
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12418
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12418
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-25/#CVE-2020-12418
• report
  https://access.redhat.com/security/cve/CVE-2020-12419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12419
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-25/#CVE-2020-12419
• report
  https://access.redhat.com/security/cve/CVE-2020-12420
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12420
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12420
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-25/#CVE-2020-12420
• report
  https://access.redhat.com/security/cve/CVE-2020-12421
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12421
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12421
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-25/#CVE-2020-12421
• report
  https://access.redhat.com/security/cve/CVE-2020-15646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1854036
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15646
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15646
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-26/#CVE-2020-15646