Summary
A sandbox escape was discovered in Thunderbird. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same origin restrictions, conduct cross-site scripting (XSS)
attacks, spoof origin attributes, or execute arbitrary code.
(CVE-2019-11709, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713,
CVE-2019-11715, CVE-2019-11717)
It was discovered that NSS incorrectly handled importing certain
curve25519 private keys. An attacker could exploit this issue to cause
Thunderbird to crash, resulting in a denial of service, or possibly
obtain sensitive information. (CVE-2019-11719)
It was discovered that NSS incorrectly handled certain p256-ECDH public
keys. An attacker could possibly exploit this issue to cause Thunderbird
to crash, resulting in a denial of service. (CVE-2019-11729)
It was discovered that Thunderbird treats all files in a directory as same
origin. If a user were tricked in to downloading a specially crafted HTML
file, an attacker could potentially exploit this to obtain sensitive
information from local files. (CVE-2019-11730)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | thunderbird | 1:60.8.0+build1-0ubuntu0.16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:60.8.0+build1-0ubuntu0.18.04.1 |
Vulnerabilities 10
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some o…
-
Unscored —
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages …
-
Unscored —
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS require…
-
Unscored —
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting …
-
Unscored —
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and l…
-
Unscored —
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being use…
-
Unscored —
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bo…
-
Unscored —
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before …
-
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack …
References
-
report
https://ubuntu.com/security/CVE-2019-9811
-
report
https://ubuntu.com/security/CVE-2019-11709
-
report
https://ubuntu.com/security/CVE-2019-11711
-
report
https://ubuntu.com/security/CVE-2019-11712
-
report
https://ubuntu.com/security/CVE-2019-11713
-
report
https://ubuntu.com/security/CVE-2019-11715
-
report
https://ubuntu.com/security/CVE-2019-11717
-
report
https://ubuntu.com/security/CVE-2019-11719
-
report
https://ubuntu.com/security/CVE-2019-11729
-
report
https://ubuntu.com/security/CVE-2019-11730