USN-3897-1

Dashboard / Vulnerabilities / USN-3897-1

USN-3897-1

Summary: thunderbird vulnerabilities

Details: A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824) Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785) Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501, CVE-2018-18505) An issue was discovered with S/MIME signature verification in some circumstances. An attacker could potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)

References: https://ubuntu.com/security/notices/USN-3897-1, https://ubuntu.com/security/CVE-2016-5824, https://ubuntu.com/security/CVE-2018-18356, https://ubuntu.com/security/CVE-2018-18500, https://ubuntu.com/security/CVE-2018-18501, https://ubuntu.com/security/CVE-2018-18505, https://ubuntu.com/security/CVE-2018-18509, https://ubuntu.com/security/CVE-2019-5785