Summary
It was discovered that Thunderbird allowed PAC files to specify that
requests to localhost are sent through the proxy to another server. If
proxy auto-detection is enabled, an attacker could potentially exploit
this to conduct attacks on local services and tools. (CVE-2018-18506)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
or execute arbitrary code. (CVE-2019-9788, CVE-2019-9790, CVE-2019-9791,
CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9810, CVE-2019-9813)
A mechanism was discovered that removes some bounds checking for string,
array, or typed array accesses if Spectre mitigations have been disabled.
If a user were tricked in to opening a specially crafted website in a
browsing context with Spectre mitigations disabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2019-9793)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | thunderbird | 1:60.6.1+build2-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | thunderbird | 1:60.6.1+build2-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:60.6.1+build2-0ubuntu0.18.04.1 |
Vulnerabilities 10
-
Unscored —
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thund…
-
Unscored —
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre miti…
-
Unscored —
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by maliciou…
-
Unscored —
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driv…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
References
-
report
https://ubuntu.com/security/CVE-2018-18506
-
report
https://ubuntu.com/security/CVE-2019-9788
-
report
https://ubuntu.com/security/CVE-2019-9790
-
report
https://ubuntu.com/security/CVE-2019-9791
-
report
https://ubuntu.com/security/CVE-2019-9792
-
report
https://ubuntu.com/security/CVE-2019-9793
-
report
https://ubuntu.com/security/CVE-2019-9795
-
report
https://ubuntu.com/security/CVE-2019-9796
-
report
https://ubuntu.com/security/CVE-2019-9810
-
report
https://ubuntu.com/security/CVE-2019-9813