libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

  - The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of     service (use-after-free) via a crafted ics file. (CVE-2016-5823)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - libical 1.0 allows remote attackers to cause a denial of     service (use-after-free) via a crafted ics file.
    (CVE-2016-5824)

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. This vulnerability affects Thunderbird < 60.5,     Firefox ESR < 60.5, and Firefox < 65. (CVE-2018-18500)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 64 and Firefox ESR 60.4.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18501)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - libical 1.0 allows remote attackers to cause a denial of     service (use-after-free) via a crafted ics file.
    (CVE-2016-5824)

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. This vulnerability affects Thunderbird < 60.5,     Firefox ESR < 60.5, and Firefox < 65. (CVE-2018-18500)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 64 and Firefox ESR 60.4.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18501)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18505)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 63 and Firefox ESR 60.3.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-12405)

  - A use-after-free vulnerability can occur after deleting     a selection element due to a weak reference to the     select element in the options collection. This results     in a potentially exploitable crash. This vulnerability     affects Thunderbird < 60.4, Firefox ESR < 60.4, and     Firefox < 64. (CVE-2018-18492)

  - A buffer overflow can occur in the Skia library during     buffer offset calculations with hardware accelerated     canvas 2D actions due to the use of 32-bit calculations     instead of 64-bit. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox <     64. (CVE-2018-18493)

  - A same-origin policy violation allowing the theft of     cross-origin URL entries when using the Javascript     location property to cause a redirection to another site     using performance.getEntries(). This is a same-origin     policy violation and could allow for data theft. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-18494)

  - A potential vulnerability leading to an integer overflow     can occur during buffer size calculations for images     when a raw value is used instead of the checked value.
    This leads to a possible out-of-bounds write. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-18498)

  - Incorrect texture handling in Angle in Google Chrome     prior to 70.0.3538.67 allowed a remote attacker to     perform an out of bounds memory read via a crafted HTML     page. (CVE-2018-17466)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - libical 1.0 allows remote attackers to cause a denial of     service (use-after-free) via a crafted ics file.
    (CVE-2016-5824)

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. This vulnerability affects Thunderbird < 60.5,     Firefox ESR < 60.5, and Firefox < 65. (CVE-2018-18500)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 64 and Firefox ESR 60.4.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18501)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process. This     vulnerability affects Thunderbird < 60.5, Firefox ESR <     60.5, and Firefox < 65. (CVE-2018-18505)

  - Mozilla developers and community members reported memory     safety bugs present in Firefox 63 and Firefox ESR 60.3.
    Some of these bugs showed evidence of memory corruption     and we presume that with enough effort that some of     these could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-12405)

  - A use-after-free vulnerability can occur after deleting     a selection element due to a weak reference to the     select element in the options collection. This results     in a potentially exploitable crash. This vulnerability     affects Thunderbird < 60.4, Firefox ESR < 60.4, and     Firefox < 64. (CVE-2018-18492)

  - A buffer overflow can occur in the Skia library during     buffer offset calculations with hardware accelerated     canvas 2D actions due to the use of 32-bit calculations     instead of 64-bit. This results in a potentially     exploitable crash. This vulnerability affects     Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox <     64. (CVE-2018-18493)

  - A same-origin policy violation allowing the theft of     cross-origin URL entries when using the Javascript     location property to cause a redirection to another site     using performance.getEntries(). This is a same-origin     policy violation and could allow for data theft. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-18494)

  - A potential vulnerability leading to an integer overflow     can occur during buffer size calculations for images     when a raw value is used instead of the checked value.
    This leads to a possible out-of-bounds write. This     vulnerability affects Thunderbird < 60.4, Firefox ESR <     60.4, and Firefox < 64. (CVE-2018-18498)

  - Incorrect texture handling in Angle in Google Chrome     prior to 70.0.3538.67 allowed a remote attacker to     perform an out of bounds memory read via a crafted HTML     page. (CVE-2018-17466)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201904-07 (Mozilla Thunderbird and Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird and       Firefox. Please review the referenced Mozilla Foundation Security       Advisories and CVE identifiers below for details.
  Impact :

    Please review the referenced Mozilla Foundation Security Advisories and       CVE identifiers below for details.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201904-02 (Libical: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Libical. Please review       the referenced CVE identifiers for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for MozillaThunderbird to version 60.5.1 fixes the following issues :

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330) :

  - CVE-2018-18356: Fixed a Use-after-free in Skia.

  - CVE-2019-5785: Fixed an Integer overflow in Skia.

  - CVE-2018-18335: Fixed a Buffer overflow in Skia by     default deactivating Canvas 2D. This issue does not     affect Linuc distributions.

  - CVE-2018-18509: Fixed a flaw which during verification     of certain S/MIME signatures showing mistekenly that     emails bring a valid sugnature. 

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824 DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bug fixes and changes :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     interface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db).

  - Address book search and auto-complete slowness

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixed Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3897-1 advisory.

    A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS     calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted message, an attacker could potentially exploit these to cause a denial of service, or execute     arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501,     CVE-2018-18505)

    An issue was discovered with S/MIME signature verification in some circumstances. An attacker could     potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaThunderbird to version 60.5.0 fixes the following issues :

Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31) :

  - CVE-2018-18500: Use-after-free parsing HTML5 stream

  - CVE-2018-18505: Privilege escalation through IPC channel     messages

  - CVE-2016-5824: DoS (use-after-free) via a crafted ics     file

  - CVE-2018-18501: Memory safety bugs fixed in Firefox 65     and Firefox ESR 60.5

  - CVE-2018-17466: Buffer overflow and out-of-bounds read     in ANGLE library with TextureStorage11

  - CVE-2018-18492: Use-after-free with select element

  - CVE-2018-18493: Buffer overflow in accelerated 2D canvas     with Skia

  - CVE-2018-18494: Same-origin policy violation using     location attribute and performance.getEntries to steal     cross-origin URLs

  - CVE-2018-18498: Integer overflow when calculating buffer     sizes for images

  - CVE-2018-12405: Memory safety bugs fixed in Firefox 64,     60.4, and Thunderbird 60.4

Other bugs fixed and changes made :

  - FileLink provider WeTransfer to upload large attachments

  - Thunderbird now allows the addition of OpenSearch search     engines from a local XML file using a minimal user     inferface: [+] button to select a file an add, [-] to     remove.

  - More search engines: Google and DuckDuckGo available by     default in some locales

  - During account creation, Thunderbird will now detect     servers using the Microsoft Exchange protocol. It will     offer the installation of a 3rd party add-on (Owl) which     supports that protocol.

  - Thunderbird now compatible with other WebExtension-based     FileLink add-ons like the Dropbox add-on

  - New WebExtensions FileLink API to facilitate add-ons

  - Fix decoding problems for messages with less common     charsets (cp932, cp936)

  - New messages in the drafts folder (and other special or     virtual folders) will no longer be included in the new     messages notification

  - Thunderbird 60 will migrate security databases (key3.db,     cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and     earlier contained a fault that potentially deleted saved     passwords and private certificate keys for users using a     master password. Version 60.3.3 will prevent the loss of     data; affected users who have already upgraded to     version 60.3.2 or earlier can restore the deleted     key3.db file from backup to complete the migration.

  - Address book search and auto-complete slowness     introduced in Thunderbird 60.3.2

  - Plain text markup with * for bold, / for italics, _ for     underline and | for code did not work when the enclosed     text contained non-ASCII characters

  - While composing a message, a link not removed when link     location was removed in the link properties panel

  - Encoding problems when exporting address books or     messages using the system charset. Messages are now     always exported using the UTF-8 encoding

  - If the 'Date' header of a message was invalid, Jan 1970     or Dec 1969 was displayed. Now using date from     'Received' header instead.

  - Body search/filtering didn't reliably ignore content of     tags

  - Inappropriate warning 'Thunderbird prevented the site     (addons.thunderbird.net) from asking you to install     software on your computer' when installing add-ons

  - Incorrect display of correspondents column since own     email address was not always detected

  - Spurious (encoded newline) inserted into drafts and sent     email

  - Double-clicking on a word in the Write window sometimes     launched the Advanced Property Editor or Link Properties     dialog

  - Fixe Cookie removal

  - 'Download rest of message' was not working if global     inbox was used

  - Fix Encoding problems for users (especially in Poland)     when a file was sent via a folder using 'Sent to > Mail     recipient' due to a problem in the Thunderbird MAPI     interface

  - According to RFC 4616 and RFC 5721, passwords containing     non-ASCII characters are encoded using UTF-8 which can     lead to problems with non-compliant providers, for     example office365.com. The SMTP LOGIN and POP3 USER/PASS     authentication methods are now using a Latin-1 encoding     again to work around this issue

  - Fix shutdown crash/hang after entering an empty IMAP     password

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

* Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

* Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

* Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

* libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es) :

  - Mozilla: Use-after-free parsing HTML5 stream     (CVE-2018-18500)

  - Mozilla: Memory safety bugs fixed in Firefox 65 and     Firefox ESR 60.5 (CVE-2018-18501)

  - Mozilla: Privilege escalation through IPC channel     messages (CVE-2018-18505)

  - libical: Multiple use-after-free vulnerabilities     (CVE-2016-5824)

The version of Thunderbird installed on the remote Windows host is prior to 60.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-03 advisory.

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. (CVE-2018-18500)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process.
    (CVE-2018-18505)

  - A vulnerability in the Libical libary used by     Thunderbird can allow remote attackers to cause a denial     of service (use-after-free) via a crafted ICS calendar     file. (CVE-2016-5824)

  - Mozilla developers and community members Alex Gaynor,     Christoph Diehl, Steven Crane, Jason Kratzer, Gary     Kwong, and Christian Holler reported memory safety bugs     present in Firefox 64, Firefox ESR 60.4, and Thunderbird     60.4. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that     some of these could be exploited to run arbitrary code.
    (CVE-2018-18501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-03 advisory.

  - A use-after-free vulnerability can occur while parsing     an HTML5 stream in concert with custom HTML elements.
    This results in the stream parser object being freed     while still in use, leading to a potentially exploitable     crash. (CVE-2018-18500)

  - An earlier fix for an Inter-process Communication (IPC)     vulnerability, CVE-2011-3079, added authentication to     communication between IPC endpoints and server parents     during IPC process creation. This authentication is     insufficient for channels created after the IPC process     is started, leading to the authentication not being     correctly applied to later channels. This could allow     for a sandbox escape through IPC channels due to lack of     message validation in the listener process.
    (CVE-2018-18505)

  - A vulnerability in the Libical libary used by     Thunderbird can allow remote attackers to cause a denial     of service (use-after-free) via a crafted ICS calendar     file. (CVE-2016-5824)

  - Mozilla developers and community members Alex Gaynor,     Christoph Diehl, Steven Crane, Jason Kratzer, Gary     Kwong, and Christian Holler reported memory safety bugs     present in Firefox 64, Firefox ESR 60.4, and Thunderbird     60.4. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort that     some of these could be exploited to run arbitrary code.
    (CVE-2018-18501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0270 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.5.0.

    Security Fix(es):

    * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

    * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

    * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

    * libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv     Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian     Holler, and Jed Davis as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0269 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 60.5.0.

    Security Fix(es):

    * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)

    * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)

    * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)

    * libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv     Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian     Holler, and Jed Davis as the original reporters.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-0270 advisory.

    [60.5.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.5.0-1]
    - Update to 60.5.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-0269 advisory.

    [60.5.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.5.0-1]
    - Update to 60.5.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libical fixes the following issues: Security issues fixed :

  - CVE-2016-5823: The icalproperty_new_clone function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (use-after-free) via a crafted ics     file. (bnc#986632)

  - CVE-2016-5824: libical 1.0 allows remote attackers to     cause a denial of service (use-after-free) via a crafted     ics file. (bsc#986639)

  - CVE-2016-5825: The icalparser_parse_string function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (out-of-bounds heap read) via a     crafted ics file. (bsc#986642)

  - CVE-2016-5826: The parser_get_next_char function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (out-of-bounds heap read) by crafting     a string to the icalparser_parse_string function.
    (bsc#986658)

  - CVE-2016-5827: The icaltime_from_string function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (out-of-bounds heap read) via a     crafted string to the icalparser_parse_string function.
    (bsc#986631)

  - CVE-2016-9584: libical allows remote attackers to cause     a denial of service (use-after-free) and possibly read     heap memory via a crafted ics file. (bnc#1015964) Bug     fixes :

  - libical crashes while parsing timezones (bsc#1044995)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libical fixes the following issues: Security issues fixed :

  - CVE-2016-5824: libical 1.0 allows remote attackers to     cause a denial of service (use-after-free) via a crafted     ics file. (bsc#986639)

  - CVE-2016-5827: The icaltime_from_string function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (out-of-bounds heap read) via a     crafted string to the icalparser_parse_string function.
    (bsc#986631)

  - CVE-2016-9584: libical allows remote attackers to cause     a denial of service (use-after-free) and possibly read     heap memory via a crafted ics file. (bsc#1015964) Bug     fixes :

  - libical crashes while parsing timezones (bsc#1044995)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libical fixes the following issues :

Security issues fixed :

  - CVE-2016-5824: libical 1.0 allows remote attackers to     cause a denial of service (use-after-free) via a crafted     ics file. (bsc#986639)

  - CVE-2016-5827: The icaltime_from_string function in     libical 0.47 and 1.0 allows remote attackers to cause a     denial of service (out-of-bounds heap read) via a     crafted string to the icalparser_parse_string function.
    (bsc#986631)

  - CVE-2016-9584: libical allows remote attackers to cause     a denial of service (use-after-free) and possibly read     heap memory via a crafted ics file. (bsc#1015964)

Bug fixes :

  - libical crashes while parsing timezones (bsc#1044995)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

It was discovered that there was a use-after-free vulnerability in the libical iCalendar library. Remote attackers could cause a denial of service and possibly read heap memory via a specially crafted .ICS file.

For Debian 7 'Wheezy', this issue has been fixed in libical version 0.48-2+deb7u1.

We recommend that you upgrade your libical packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199868	RHEL 5 : thunderbird (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195332	RHEL 5 : libical (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
127434	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0156)	Nessus	NewStart CGSL Local Security Checks	critical
127315	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0093)	Nessus	NewStart CGSL Local Security Checks	critical
127238	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0052)	Nessus	NewStart CGSL Local Security Checks	critical
123581	GLSA-201904-07 : Mozilla Thunderbird and Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
123576	GLSA-201904-02 : Libical: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
122493	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-251)	Nessus	SuSE Local Security Checks	critical
122482	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Thunderbird vulnerabilities (USN-3897-1)	Nessus	Ubuntu Local Security Checks	critical
122224	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-182)	Nessus	SuSE Local Security Checks	critical
122065	CentOS 7 : thunderbird (CESA-2019:0270)	Nessus	CentOS Local Security Checks	critical
122064	CentOS 6 : thunderbird (CESA-2019:0269)	Nessus	CentOS Local Security Checks	critical
121631	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190204)	Nessus	Scientific Linux Local Security Checks	critical
121607	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190204)	Nessus	Scientific Linux Local Security Checks	critical
121600	Mozilla Thunderbird < 60.5	Nessus	Windows	critical
121599	Mozilla Thunderbird < 60.5	Nessus	MacOS X Local Security Checks	critical
121586	RHEL 7 : thunderbird (RHSA-2019:0270)	Nessus	Red Hat Local Security Checks	critical
121585	RHEL 6 : thunderbird (RHSA-2019:0269)	Nessus	Red Hat Local Security Checks	critical
121584	Oracle Linux 7 : thunderbird (ELSA-2019-0270)	Nessus	Oracle Linux Local Security Checks	critical
121583	Oracle Linux 6 : thunderbird (ELSA-2019-0269)	Nessus	Oracle Linux Local Security Checks	critical
106130	SUSE SLES11 Security Update : Recommended update for libical (SUSE-SU-2018:0119-1)	Nessus	SuSE Local Security Checks	critical
102067	SUSE SLED12 / SLES12 Security Update : libical (SUSE-SU-2017:1989-1)	Nessus	SuSE Local Security Checks	critical
102058	openSUSE Security Update : libical (openSUSE-2017-869)	Nessus	SuSE Local Security Checks	critical
100479	Debian DLA-959-1 : libical security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-5824

medium

Tenable Plugins

medium

high

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical