Lucene search

K
mageiaGentoo FoundationMGASA-2019-0316
HistoryNov 08, 2019 - 2:36 a.m.

Updated thunderbird packages fix security vulnerabilities

2019-11-0802:36:48
Gentoo Foundation
advisories.mageia.org
29

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.015 Low

EPSS

Percentile

86.9%

The updated packages fix security issues: Use-after-free when creating index updates in IndexedDB. (CVE-2019-11757) Potentially exploitable crash due to 360 Total Security. (CVE-2019-11758) Stack buffer overflow in HKDF output. (CVE-2019-11759) Stack buffer overflow in WebRTC networking. (CVE-2019-11760) Unintended access to a privileged JSONView object. (CVE-2019-11761) document.domain-based origin isolation has same-origin-property violation. (CVE-2019-11762) Incorrect HTML parsing results in XSS bypass technique. (CVE-2019-11763) Memory safety bugs fixed in Thunderbird 68.2. (CVE-2019-11764) Heap overflow in expat library in XML_GetCurrentLineNumber. (CVE-2019-15903) Enigmail has been updated to 2.1.3.

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.015 Low

EPSS

Percentile

86.9%