Summary
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2023-0616, CVE-2023-25735,
CVE-2023-25737, CVE-2023-25739, CVE-2023-25729, CVE-2023-25742,
CVE-2023-25746)
Johan Carlsson discovered that Thunderbird did not properly implement CSP
policy on a header when using iframes. An attacker could potentially
exploits this to exfiltrate data. (CVE-2023-25728)
Irvan Kurniawan discovered that Thunderbird was not properly handling
background fullscreen scripts when the window goes into fullscreen mode.
An attacker could possibly use this issue to spoof the user and obtain
sensitive information. (CVE-2023-25730)
Christian Holler discovered that Thunderbird did not properly check the
Safe Bag attributes in PKCS 12 certificate bundle. An attacker could
possibly use this issue to write to arbitrary memory by sending malicious
PKCS 12 certificate. (CVE-2023-0767)
Ronald Crane discovered that Thunderbird did not properly check the size of
the input being encoded in xpcom. An attacker could possibly use this issue
to perform out of bound memory write operations. (CVE-2023-25732)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | thunderbird | 1:102.8.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | thunderbird | 1:102.8.0+build2-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | thunderbird | 1:102.8.0+build2-0ubuntu0.22.04.1 |
Vulnerabilities 11
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…
-
High 8.8
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…
-
High 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
High 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…
-
High 8.8
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…
-
High 8.8
Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…
-
Medium 6.5
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Unscored —
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. Thi…
References
-
report
https://ubuntu.com/security/CVE-2023-0616
-
report
https://ubuntu.com/security/CVE-2023-0767
-
report
https://ubuntu.com/security/CVE-2023-25728
-
report
https://ubuntu.com/security/CVE-2023-25729
-
report
https://ubuntu.com/security/CVE-2023-25730
-
report
https://ubuntu.com/security/CVE-2023-25732
-
report
https://ubuntu.com/security/CVE-2023-25735
-
report
https://ubuntu.com/security/CVE-2023-25737
-
report
https://ubuntu.com/security/CVE-2023-25739
-
report
https://ubuntu.com/security/CVE-2023-25742
-
report
https://ubuntu.com/security/CVE-2023-25746