KLA11278 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Buffer overflow vulnerability occurs during rendering of canvas element in Thunderbird can be exploited remotely to cause denial of service;
2. Use-after-free vulnerability occurs when deleting an input element can be exploited remotely to cause denial of service;
3. Multiple vulnerabilities related to decrypted S/MIME parts can be exploited remotely to obtain sensitive information;
4. Integer overflow vulnerability in SSSE3 scaler can be exploited remotely via specially designed website to cause denial of service;
5. Use-after-free vulnerability occurring in moving DOM nodes between documents can be exploited remotely via specially designed website to cause denial of service;
6. incorrect requests handling in NPAPI plugins can be exploited remotely via specially designed website to obtain sensitive information;
7. Vulnerability in IPC sandbox security policy can be exploited remotely via specially designed website to obtain sensitive information;
8. Out-of-bounds read vulnerability in QCMS can be exploited remotely via specially designed website to obtain sensitive information;
9. Vulnerability related to the browser does not warn users when opening executable files with the SettingContent-ms extension;
10. Multiple memory corruption vulnerabilities in Mozilla Thunderbird can be exploited via unspecified vector to execute arbitrary code.

Original advisories

Mozilla Foundation Security Advisory 2018-18

Related products

Mozilla-Thunderbird

CVE list

CVE-2018-12359 high

CVE-2018-12360 high

CVE-2018-12362 high

CVE-2018-12363 high

CVE-2018-12364 high

CVE-2018-12365 warning

CVE-2018-12366 warning

CVE-2018-12368 critical

CVE-2018-5188 critical

CVE-2018-12372 warning

CVE-2018-12373 warning

CVE-2018-12374 warning

Solution

Update to latest version

Download Mozilla Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Thunderbird earlier than 52.9