7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.122 Low
EPSS
Percentile
95.4%
Severity: Critical
Date : 2018-05-21
CVE-ID : CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5159
CVE-2018-5161 CVE-2018-5162 CVE-2018-5168 CVE-2018-5170
CVE-2018-5178 CVE-2018-5183 CVE-2018-5184 CVE-2018-5185
Package : thunderbird
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-707
The package thunderbird before version 52.8.0-1 is vulnerable to
multiple issues including arbitrary code execution, information
disclosure, access restriction bypass, content spoofing and denial of
service.
Upgrade to 52.8.0-1.
The problems have been fixed upstream in version 52.8.0.
Most of these issues can be mitigated by viewing e-mails in plain text
mode, via the “View”, “Message Body As”, “Plain Text” menus.
Several memory safety bugs have been found in Firefox before 60.0 and
Thunderbird before 52.8. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could be exploited to run arbitrary code.
A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while enumerating attributes during SVG animations
with clip paths.
A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while adjusting layout during SVG animations with
text paths.
An integer overflow vulnerability has been found in the Skia library
used in Firefox < 60.0 and Thunderbird < 52.8, due to 32-bit integer
use in an array without integer overflow checks, resulting in possible
out-of-bounds writes. This could lead to a potentially exploitable
crash triggerable by web content.
A security issue has been found in Thunderbird before 52.8, where
crafted message headers can cause a Thunderbird process to hang on
receiving the message.
A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through the src attribute of
remote images, or links.
Sites can bypass security checks on permissions to install lightweight
themes in Firefox before 60.0 and Thunderbird before 52.8, by
manipulating the baseURI property of the theme element. This could
allow a malicious site to install a theme without user interaction
which could contain offensive or embarrassing images.
It is possible in Thunderbird before 52.8 to spoof the filename of an
attachment and display an arbitrary attachment name. This could lead to
a user opening a remote attachment which is a different file type than
expected.
A buffer overflow was found in Thunderbird before 52.8, during UTF8 to
Unicode string conversion within JavaScript with extremely large
amounts of data. This vulnerability requires the use of a malicious or
vulnerable legacy extension in order to occur.
Several memory corruption issues including invalid buffer reads and
writes during graphic operations have been found in the Skia library.
A security issue has been found in Thunderbird before 52.8, where using
remote content in S/MIME encrypted messages can lead to the disclosure
of plaintext via chosen-ciphertext attack.
A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through by user submitting an
embedded form.
A remote attacker might be able to access sensitive information via a
crafted encrypted e-mail, and spoof the name of an attachment. A remote
attacker might also be able to access sensitive information, crash the
process or execute arbitrary code via a crafted HTML e-mail if viewing
HTML messages is enabled.
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154
https://bugzilla.mozilla.org/show_bug.cgi?id=1443092
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155
https://bugzilla.mozilla.org/show_bug.cgi?id=1448774
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159
https://bugzilla.mozilla.org/show_bug.cgi?id=1441941
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161
https://bugzilla.mozilla.org/show_bug.cgi?id=1411720
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162
https://bugzilla.mozilla.org/show_bug.cgi?id=1457721
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168
https://bugzilla.mozilla.org/show_bug.cgi?id=1449548
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170
https://bugzilla.mozilla.org/show_bug.cgi?id=1411732
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178
https://bugzilla.mozilla.org/show_bug.cgi?id=1443891
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183
https://bugzilla.mozilla.org/show_bug.cgi?id=1454692
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184
https://bugzilla.mozilla.org/show_bug.cgi?id=1411592
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185
https://bugzilla.mozilla.org/show_bug.cgi?id=1450345
https://security.archlinux.org/CVE-2018-5150
https://security.archlinux.org/CVE-2018-5154
https://security.archlinux.org/CVE-2018-5155
https://security.archlinux.org/CVE-2018-5159
https://security.archlinux.org/CVE-2018-5161
https://security.archlinux.org/CVE-2018-5162
https://security.archlinux.org/CVE-2018-5168
https://security.archlinux.org/CVE-2018-5170
https://security.archlinux.org/CVE-2018-5178
https://security.archlinux.org/CVE-2018-5183
https://security.archlinux.org/CVE-2018-5184
https://security.archlinux.org/CVE-2018-5185
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | thunderbird | < 52.8.0-1 | UNKNOWN |
bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129
bugzilla.mozilla.org/show_bug.cgi?id=1411592
bugzilla.mozilla.org/show_bug.cgi?id=1411720
bugzilla.mozilla.org/show_bug.cgi?id=1411732
bugzilla.mozilla.org/show_bug.cgi?id=1441941
bugzilla.mozilla.org/show_bug.cgi?id=1443092
bugzilla.mozilla.org/show_bug.cgi?id=1443891
bugzilla.mozilla.org/show_bug.cgi?id=1448774
bugzilla.mozilla.org/show_bug.cgi?id=1449548
bugzilla.mozilla.org/show_bug.cgi?id=1450345
bugzilla.mozilla.org/show_bug.cgi?id=1454692
bugzilla.mozilla.org/show_bug.cgi?id=1457721
security.archlinux.org/AVG-707
security.archlinux.org/CVE-2018-5150
security.archlinux.org/CVE-2018-5154
security.archlinux.org/CVE-2018-5155
security.archlinux.org/CVE-2018-5159
security.archlinux.org/CVE-2018-5161
security.archlinux.org/CVE-2018-5162
security.archlinux.org/CVE-2018-5168
security.archlinux.org/CVE-2018-5170
security.archlinux.org/CVE-2018-5178
security.archlinux.org/CVE-2018-5183
security.archlinux.org/CVE-2018-5184
security.archlinux.org/CVE-2018-5185
www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150
www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154
www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155
www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159
www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168
www.mozilla.org/en-US/security/advisories/mfsa2018-13/
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184
www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.122 Low
EPSS
Percentile
95.4%