KLA11411 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code.
Below is a complete list of vulnerabilities:

Use-after-free vulnerability can be exploited remotely via specially designed HTML5 stream to cause denial of service.
Inter-process Communication (IPC) vulnerability can be exploited remotely via attempt to communicate with the IPC object without validation to bypass security restrictions.
Use-after-free vulnerability in the Libical libary in Thunderbird can be exploited remotely via a specially designed ICS calendar to cause a denial of service.
Multiple memory corruption vulnerabilities can be exploited remotely to execute arbitrary code.

2. Use-after-free vulnerability can be exploited remotely via specially designed HTML5 stream to cause denial of service.
3. Inter-process Communication (IPC) vulnerability can be exploited remotely via attempt to communicate with the IPC object without validation to bypass security restrictions.
4. Use-after-free vulnerability in the Libical libary in Thunderbird can be exploited remotely via a specially designed ICS calendar to cause a denial of service.
5. Multiple memory corruption vulnerabilities can be exploited remotely to execute arbitrary code.

Original advisories

Mozilla Foundation Security Advisory 2019-03

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Mozilla-Thunderbird

Mozilla-Thunderbird-ESR

CVE list

CVE-2018-18500 critical

CVE-2018-18505 critical

CVE-2018-18501 critical

CVE-2016-5824 warning

CVE-2018-18512 critical

CVE-2018-18513 warning

Solution

Update to the latest version

Download Mozilla Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Mozilla Thunderbird earlier than 60.5