KLA11425 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A use-after-free vulnerability related to Skia library can be exploited remotely to cause denial of service;
2. An integer overflow vulnerability related to Skia library can be exploited remotely to cause denial of service;
3. A buffer overflow vulnerability related to Skia library can be exploited remotely to cause denial of service;
4. A vulnerability related to verification of certain S/MIME signatures can be exploited remotely to bypass security restrictions.

Technical details

Vulnerability (3) affected only macOS platform.

Original advisories

Mozilla Foundation Security Advisory 2019-06

Related products

Mozilla-Thunderbird

CVE list

CVE-2018-18335 high

CVE-2018-18356 high

CVE-2019-5785 warning

CVE-2018-18509 warning

Solution

Update to the latest version

Download Mozilla Thunderbird

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Mozilla Thunderbird earlier than 60.5.1