openSUSE-SU-2019:1664-1

    Dashboard / Vulnerabilities / openSUSE-SU-2019:1664-1

    openSUSE-SU-2019:1664-1

    Published: 28 Jun 2019Last Modified: 4 Feb 2026

    Summary: Security update for MozillaThunderbird

    Details: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872): * CVE-2019-11707: Type confusion in Array.pop * CVE-2019-11708: sandbox escape using Prompt:Open Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595): * CVE-2019-11703: Heap buffer overflow in icalparser.c * CVE-2019-11704: Heap buffer overflow in icalvalue.c * CVE-2019-11705: Stack buffer overflow in icalrecur.c * CVE-2019-11706: Type confusion in icalproperty.c Also fixed: No prompt for smartcard PIN when S/MIME signing is used Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824): * Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut * CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816: Type confusion with object groups and UnboxedObjects * CVE-2019-9817: Stealing of cross-domain images using canvas * CVE-2019-9818 (Windows only): Use-after-free in crash generation server * CVE-2019-9819: Compartment mismatch with fetch API * CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell * CVE-2019-11691: Use-after-free in XMLHttpRequest * CVE-2019-11692: Use-after-free removing listeners in the event listener manager * CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux * CVE-2019-7317: Use-after-free in png_image_free of libpng library * CVE-2019-9797: Cross-origin theft of images with createImageBitmap * CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox * CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks * CVE-2019-5798: Out-of-bounds read in Skia * CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 - Disable building with LTO (boo#1133267).

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/ZFVBHHF6WMJDJB73NZDWFFGS6D23TB67/#ZFVBHHF6WMJDJB73NZDWFFGS6D23TB67, https://bugzilla.suse.com/1130694, https://bugzilla.suse.com/1133267, https://bugzilla.suse.com/1135824, https://bugzilla.suse.com/1137595, https://bugzilla.suse.com/1138872, https://www.suse.com/security/cve/CVE-2018-18511, https://www.suse.com/security/cve/CVE-2019-11691, https://www.suse.com/security/cve/CVE-2019-11692, https://www.suse.com/security/cve/CVE-2019-11693, https://www.suse.com/security/cve/CVE-2019-11694, https://www.suse.com/security/cve/CVE-2019-11698, https://www.suse.com/security/cve/CVE-2019-11703, https://www.suse.com/security/cve/CVE-2019-11704, https://www.suse.com/security/cve/CVE-2019-11705, https://www.suse.com/security/cve/CVE-2019-11706, https://www.suse.com/security/cve/CVE-2019-11707, https://www.suse.com/security/cve/CVE-2019-11708, https://www.suse.com/security/cve/CVE-2019-5798, https://www.suse.com/security/cve/CVE-2019-7317, https://www.suse.com/security/cve/CVE-2019-9797, https://www.suse.com/security/cve/CVE-2019-9800, https://www.suse.com/security/cve/CVE-2019-9815, https://www.suse.com/security/cve/CVE-2019-9816, https://www.suse.com/security/cve/CVE-2019-9817, https://www.suse.com/security/cve/CVE-2019-9818, https://www.suse.com/security/cve/CVE-2019-9819, https://www.suse.com/security/cve/CVE-2019-9820

    Affected packages

    Package

    Name: MozillaThunderbird

    Purl: pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -60.7.2-85.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2019:1664-1 | CVE-DB