Detections
Analytics

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-182)

critical Nessus Plugin ID 122224

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for MozillaThunderbird to version 60.5.0 fixes the following issues :

Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31) :

 - CVE-2018-18500: Use-after-free parsing HTML5 stream

 - CVE-2018-18505: Privilege escalation through IPC channel messages

 - CVE-2016-5824: DoS (use-after-free) via a crafted ics file

 - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

 - CVE-2018-18492: Use-after-free with select element

 - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia

 - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs

 - CVE-2018-18498: Integer overflow when calculating buffer sizes for images

 - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4

Other bugs fixed and changes made :

 - FileLink provider WeTransfer to upload large attachments

 - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove.

 - More search engines: Google and DuckDuckGo available by default in some locales

 - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol.

 - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on

 - New WebExtensions FileLink API to facilitate add-ons

 - Fix decoding problems for messages with less common charsets (cp932, cp936)

 - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification

 - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration.

 - Address book search and auto-complete slowness introduced in Thunderbird 60.3.2

 - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters

 - While composing a message, a link not removed when link location was removed in the link properties panel

 - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding

 - If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from 'Received' header instead.

 - Body search/filtering didn't reliably ignore content of tags

 - Inappropriate warning 'Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer' when installing add-ons

 - Incorrect display of correspondents column since own email address was not always detected

 - Spurious (encoded newline) inserted into drafts and sent email

 - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog

 - Fixe Cookie removal

 - 'Download rest of message' was not working if global inbox was used

 - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using 'Sent to > Mail recipient' due to a problem in the Thunderbird MAPI interface

 - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue

 - Fix shutdown crash/hang after entering an empty IMAP password

Solution

Update the affected MozillaThunderbird packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1122983

Plugin Details

Severity: Critical

ID: 122224

File Name: openSUSE-2019-182.nasl

Version: 1.5

Type: local

Agent: unix

Published: 2/15/2019

Updated: 6/20/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-18505

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:mozillathunderbird-translations-other, p-cpe:/a:novell:opensuse:mozillathunderbird, p-cpe:/a:novell:opensuse:mozillathunderbird-buildsymbols, p-cpe:/a:novell:opensuse:mozillathunderbird-translations-common, p-cpe:/a:novell:opensuse:mozillathunderbird-debugsource, p-cpe:/a:novell:opensuse:mozillathunderbird-debuginfo, cpe:/o:novell:opensuse:42.3

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/14/2019

Vulnerability Publication Date: 1/27/2017

Reference Information

CVE: CVE-2016-5824, CVE-2018-12405, CVE-2018-17466, CVE-2018-18492, CVE-2018-18493, CVE-2018-18494, CVE-2018-18498, CVE-2018-18500, CVE-2018-18501, CVE-2018-18505