Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same-origin protections, or execute arbitrary code.
(CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,
CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service, or execute
arbitrary code. (CVE-2019-5798, CVE-2019-7317)
A type confusion bug was discovered with object groups and UnboxedObjects.
If a user were tricked in to opening a specially crafted website in a
browsing context after enabling the UnboxedObjects feature, an attacker
could potentially exploit this to bypass security checks. (CVE-2019-9816)
It was discovered that history data could be exposed via drag and drop
of hyperlinks to and from bookmarks. If a user were tricked in to dragging
a specially crafted hyperlink to a bookmark toolbar or sidebar, and
subsequently back in to the web content area, an attacker could
potentially exploit this to obtain sensitive information. (CVE-2019-11698)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | thunderbird | 1:60.7.0+build1-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:60.7.0+build1-0ubuntu0.18.04.1 |
Vulnerabilities 13
-
Medium 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…
-
Unscored —
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImag…
-
Unscored —
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …
-
Unscored —
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…
-
Unscored —
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…
-
Unscored —
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…
-
Unscored —
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an …
-
Unscored —
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBit…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thund…
-
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
Unscored —
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal ima…
-
Unscored —
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a pote…
-
Unscored —
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …
References
-
report
https://ubuntu.com/security/CVE-2018-18511
-
report
https://ubuntu.com/security/CVE-2019-5798
-
report
https://ubuntu.com/security/CVE-2019-7317
-
report
https://ubuntu.com/security/CVE-2019-9797
-
report
https://ubuntu.com/security/CVE-2019-9800
-
report
https://ubuntu.com/security/CVE-2019-9816
-
report
https://ubuntu.com/security/CVE-2019-9817
-
report
https://ubuntu.com/security/CVE-2019-9819
-
report
https://ubuntu.com/security/CVE-2019-9820
-
report
https://ubuntu.com/security/CVE-2019-11691
-
report
https://ubuntu.com/security/CVE-2019-11692
-
report
https://ubuntu.com/security/CVE-2019-11693
-
report
https://ubuntu.com/security/CVE-2019-11698