KLA11453 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code and bypass security restrictions.

Below is a complete list of vulnerabilities:

1. Buffer overflow vulnerability in IonMonkey JIT compiler can be exploited remotely to execute arbitrary code;
2. Type confusion vulnerability in IonMonkey JIT compiler can be exploited remotely to bypass security restrictions.

Original advisories

mfsa2019-12

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Mozilla-Thunderbird

CVE list

CVE-2019-9810 high

CVE-2019-9813 high

Solution

Update to the latest version

Download Mozilla Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Mozilla Thunderbird earlier than 60.6.1