Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
conduct cross-site scripting (XSS) attacks, or execute arbitrary code.
(CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011,
CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022,
CVE-2019-17024, CVE-2019-17026)
It was discovered that NSS incorrectly handled certain memory operations.
A remote attacker could potentially exploit this to cause a denial of
service, or execute arbitrary code. (CVE-2019-11745)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:68.4.1+build1-0ubuntu0.18.04.1 |
Vulnerabilities 11
-
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021 -
Unscored —
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a s…
-
Unscored —
The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was poss…
-
Unscored —
When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially explo…
-
Unscored —
Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race c…
-
Unscored —
Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could c…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed ev…
-
Unscored —
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @…
-
Unscored —
Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presu…
-
Unscored —
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed ev…
References
-
report
https://ubuntu.com/security/CVE-2019-11745
-
report
https://ubuntu.com/security/CVE-2019-17005
-
report
https://ubuntu.com/security/CVE-2019-17008
-
report
https://ubuntu.com/security/CVE-2019-17010
-
report
https://ubuntu.com/security/CVE-2019-17011
-
report
https://ubuntu.com/security/CVE-2019-17012
-
report
https://ubuntu.com/security/CVE-2019-17016
-
report
https://ubuntu.com/security/CVE-2019-17017
-
report
https://ubuntu.com/security/CVE-2019-17022
-
report
https://ubuntu.com/security/CVE-2019-17024
-
report
https://ubuntu.com/security/CVE-2019-17026