From foxboron@archlinux.org Tue Jan 14 19:17:58 2020
From: Morten Linderud <foxboron@archlinux.org>
To: arch-security@lists.archlinux.org
Subject: [ASA-202001-4] thunderbird: multiple issues
Date: Tue, 14 Jan 2020 20:17:39 +0100
Message-ID: <20200114191739.c33nelsp6cfnldyr@anathema>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4682619001867615757=="

--===============4682619001867615757==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Arch Linux Security Advisory ASA-202001-4
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Severity: Critical
Date    : 2020-01-14
CVE-ID  : CVE-2019-17016 CVE-2019-17017 CVE-2019-17022 CVE-2019-17024
          CVE-2019-17026
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1086

Summary
=3D=3D=3D=3D=3D=3D=3D

The package thunderbird before version 68.4.1-1 is vulnerable to
multiple issues including arbitrary code execution and insufficient
validation.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Upgrade to 68.4.1-1.

# pacman -Syu "thunderbird>=3D68.4.1-1"

The problems have been fixed upstream in version 68.4.1.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

None.

Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

- CVE-2019-17016 (insufficient validation)

A security issue has been found in Firefox before 72.0, and Thunderbird
before 68.4.1. When pasting a <style> tag from the clipboard into a
rich text editor, the CSS sanitizer incorrectly rewrites a @namespace
rule. This could allow for injection into certain types of websites
resulting in data exfiltration.

- CVE-2019-17017 (arbitrary code execution)

A type confusion issue has been found in Firefox before 72.0, and
Thunderbird before 68.4.1, in XPCVariant.cpp where, due to a missing
case handling object types, a type confusion vulnerability could occur,
resulting in a crash.

- CVE-2019-17022 (insufficient validation)

A security issue has been found in Firefox before 72.0, and Thunderbird
before 68.4.1 where CSS sanitization does not escape HTML tags. When
pasting a <style> tag from the clipboard into a rich text editor, the
CSS sanitizer does not escape < and > characters. Because the resulting
string is pasted directly into the text node of the element this does
not result in a direct injection into the webpage; however, if a
webpage subsequently copies the node's innerHTML, assigning it to
another innerHTML, this would result in an XSS vulnerability. Two
WYSIWYG editors were identified with this behavior, more may exist.

- CVE-2019-17024 (arbitrary code execution)

Several memory safety issues have been found in Firefox before 72.0,
Firefox ESR before 68.4.1, and Thunderbird before 68.3. Some of these
bugs showed evidence of memory corruption and Mozilla presumes that
with enough effort some of these could have been exploited to run
arbitrary code.

- CVE-2019-17026 (arbitrary code execution)

A type confusion vulnerability has been found in Firefox before 72.0.1,
and Thunderbird before 68.4.1. Incorrect alias information in IonMonkey
JIT compiler for setting array elements could lead to a type confusion
with StoreElementHole and FallibleStoreElement. Mozilla is aware of
targeted attacks in the wild abusing this flaw.

Impact
=3D=3D=3D=3D=3D=3D

A remote attacker could bypass security measures or execute arbitrary
code on the affected host.

References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17016
https://bugzilla.mozilla.org/show_bug.cgi?id=3D1599181
https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17017
https://bugzilla.mozilla.org/show_bug.cgi?id=3D1603055
https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17022
https://bugzilla.mozilla.org/show_bug.cgi?id=3D1602843
https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17024
https://bugzilla.mozilla.org/buglist.cgi?bug_id=3D1507180%2C1595470%2C1598605=
%2C1601826
https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-17026
https://bugzilla.mozilla.org/show_bug.cgi?id=3D1607443
https://security.archlinux.org/CVE-2019-17016
https://security.archlinux.org/CVE-2019-17017
https://security.archlinux.org/CVE-2019-17022
https://security.archlinux.org/CVE-2019-17024
https://security.archlinux.org/CVE-2019-17026

--===============4682619001867615757==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUVCQ2dBZEZpRUVrdG5HemVtYUlD
VFdrS2R1NTBKb082Q01zdjhGQWw0ZUU5TUFDZ2tRNTBKb082Q00Kc3Y4ZUZCQUFta3orcGtoL2ZZ
Y0IzZldBeFM0elNkek1SVnlWZ2VjZDdvZXZwcWVoZWhiNlZzU2NiRlAzc2VpOQpVZXdnWGRYYXZi
UmVmYlVOOUh3b3lFMDJhUllmQTRqV0d0WksxMEZTTWRrRDRZQmM4NTVjdjErODBUY3drV0Y4Ck1Z
b0s4TTJ4WFBTYnZlUjRWQjUwdXBKb0ErZkFLaFd5Z2RpZVpncVJSUDh3Q1duanBMWHZCbFRoTnB6
OEczWjQKclhDZFlYV1lscFdEK0ZiSVpZWURqVUpiUWtPOXB4WVhUelZpamhFdUt4emRRbmV4T2sr
WTFHbGdkZ3J6VnFwNApib2JTYlh3OWlVaTlFUXFVbjFUckNoVnlDWXVtMlovejYxNXVqekVCUXhO
RFY0bm5UTlkxSEZpWGhUaFpRWUluCjFkT1dUZGY5UFh4Y3ZYQTByWml5MXROclhGMlFIcmM3RWJW
WHJmUDFHVXJCU3JNZXl3Q1RjSnlqY09CTTErR3AKSHIvd2haZ0U3S1RTN3pQcGNxTkZkVkQ5MTU0
QnRLRlZLcHowaUZYQlViNmtYdGZFL0hWdEtrc3RDWTBJU0FhdgpCRXVjK2NuYlMrcE4vM2JNc1JZ
Nk5DdFlMUWRURnBkbktqNG5GUFB3YUZhQWJWM3RHM3g4WWRIV2REMkxuUUN1CkNINnR5WFhOV0FO
MmpSN3Nsd2xvOUVTQWIvdlUyYnZ6bW1UNTdnWkxCdy9wQzl1VnlOUWNvYU1hM043MUZkdEMKenV3
NWIrZy9LUVE2dTdaQ1M5WnMxalNYZVRYbEZrZ0lRVGRGQTVQbGYwUlBZVURvVDU0N2VQNU1HQ0Iy
aGNISgo5bmlrOUdYYWF3cmlFTDVZQUs2UDlrby81emtjZ0VGalpRQ0tlZFdjejhWeGZYMFB5SkU9
Cj14ZUdiCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--===============4682619001867615757==--