openSUSE-SU-2018:0257-1

    Dashboard / Vulnerabilities / openSUSE-SU-2018:0257-1

    openSUSE-SU-2018:0257-1

    Published: 27 Jan 2018Last Modified: 2 May 2025

    Summary: Security update for MozillaThunderbird

    Details: This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/IQKYFID4LB22UT3U2EOJ242RTGFRORJJ/#IQKYFID4LB22UT3U2EOJ242RTGFRORJJ, https://bugzilla.suse.com/1077291, https://www.suse.com/security/cve/CVE-2018-5089, https://www.suse.com/security/cve/CVE-2018-5095, https://www.suse.com/security/cve/CVE-2018-5096, https://www.suse.com/security/cve/CVE-2018-5097, https://www.suse.com/security/cve/CVE-2018-5098, https://www.suse.com/security/cve/CVE-2018-5099, https://www.suse.com/security/cve/CVE-2018-5102, https://www.suse.com/security/cve/CVE-2018-5103, https://www.suse.com/security/cve/CVE-2018-5104, https://www.suse.com/security/cve/CVE-2018-5117

    Affected packages

    Package

    Name: MozillaThunderbird

    Purl: pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -52.6-54.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2018:0257-1 | CVE-DB