KLA11299 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A buffer overflow vulnerability can be exploited remotely to cause denial of service;
2. Multiple use-after-free vulnerabilities can be exploited remotely to cause denial of service;
3. An integer overflow vulnerability in SwizzleData can be exploited remotely to cause denial of service;
4. An integer overflow vulnerability in SSSE3 scaler can be exploited remotely to cause denial of service;
5. A type confusion vulnerability can be exploited remotely to cause denial of service;
6. A CORS bypass vulnerability in NPAPI plugins can be exploited remotely to bypass security restrictions;
7. Multiple unspecified vulnerabilities can be exploited locally to obtain sensitive information;
8. An integer overflow vulnerability in Skia scaler can be exploited remotely to cause denial of service.

Original advisories

Mozilla Foundation Security Advisory 2018-19

Related products

Mozilla-Thunderbird

CVE list

CVE-2018-12359 high

CVE-2018-12360 high

CVE-2018-12361 high

CVE-2018-12362 high

CVE-2018-12363 high

CVE-2018-12364 high

CVE-2018-12365 warning

CVE-2018-12366 warning

CVE-2018-12367 warning

CVE-2018-12368 critical

CVE-2018-12371 high

CVE-2018-5156 critical

CVE-2018-5187 critical

CVE-2018-5188 critical

Solution

Update to the latest version

Download Mozilla Thunderbird

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Thunderbird earlier than 60