From Red Hat Security Advisory 2019:4195 :

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:4195 advisory.

  - Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

  - Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

  - Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

  - Mozilla: Use-after-free in worker destruction     (CVE-2019-17008)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and     Firefox ESR 68.3 (CVE-2019-17012)

  - Mozilla: Buffer overflow in plain text serializer     (CVE-2019-17005)

  - Mozilla: Use-after-free when performing device     orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in     antitracking (CVE-2019-17011)

This update for MozillaFirefox fixes the following issues :

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed :

CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)

CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)

CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)

CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)

CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)

CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)

CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)

CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The plain text serializer used a fixed-size array for the number of ol elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17005)

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17010)

When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17008)

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
(CVE-2019-17012)

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17011)

ID	Name	Product	Family	Published	Updated	Severity
131974	Oracle Linux 8 : thunderbird (ELSA-2019-4195)	Nessus	Oracle Linux Local Security Checks	12/12/2019	4/4/2024	high
131985	RHEL 8 : thunderbird (RHSA-2019:4195)	Nessus	Red Hat Local Security Checks	12/12/2019	4/28/2024	high
131989	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20191210)	Nessus	Scientific Linux Local Security Checks	12/12/2019	4/4/2024	high
132308	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:3337-1)	Nessus	SuSE Local Security Checks	12/19/2019	4/2/2024	high
132482	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0265)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	4/2/2024	high
133149	Amazon Linux 2 : thunderbird (ALAS-2020-1386)	Nessus	Amazon Linux Local Security Checks	1/22/2020	3/29/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high