Arch Linux Security Advisory ASA-201805-21 ========================================== Severity: Critical Date : 2018-05-21 CVE-ID : CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5159 CVE-2018-5161 CVE-2018-5162 CVE-2018-5168 CVE-2018-5170 CVE-2018-5178 CVE-2018-5183 CVE-2018-5184 CVE-2018-5185 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-707 Summary ======= The package thunderbird before version 52.8.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, access restriction bypass, content spoofing and denial of service. Resolution ========== Upgrade to 52.8.0-1. # pacman -Syu "thunderbird>=52.8.0-1" The problems have been fixed upstream in version 52.8.0. Workaround ========== Most of these issues can be mitigated by viewing e-mails in plain text mode, via the "View", "Message Body As", "Plain Text" menus. Description =========== - CVE-2018-5150 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 60.0 and Thunderbird before 52.8. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5154 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0 and Thunderbird < 52.8, while enumerating attributes during SVG animations with clip paths. - CVE-2018-5155 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0 and Thunderbird < 52.8, while adjusting layout during SVG animations with text paths. - CVE-2018-5159 (arbitrary code execution) An integer overflow vulnerability has been found in the Skia library used in Firefox < 60.0 and Thunderbird < 52.8, due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. - CVE-2018-5161 (denial of service) A security issue has been found in Thunderbird before 52.8, where crafted message headers can cause a Thunderbird process to hang on receiving the message. - CVE-2018-5162 (information disclosure) A security issue has been found in Thunderbird before 52.8, where plaintext of decrypted emails can leak through the src attribute of remote images, or links. - CVE-2018-5168 (access restriction bypass) Sites can bypass security checks on permissions to install lightweight themes in Firefox before 60.0 and Thunderbird before 52.8, by manipulating the baseURI property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. - CVE-2018-5170 (content spoofing) It is possible in Thunderbird before 52.8 to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. - CVE-2018-5178 (information disclosure) A buffer overflow was found in Thunderbird before 52.8, during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. - CVE-2018-5183 (arbitrary code execution) Several memory corruption issues including invalid buffer reads and writes during graphic operations have been found in the Skia library. - CVE-2018-5184 (information disclosure) A security issue has been found in Thunderbird before 52.8, where using remote content in S/MIME encrypted messages can lead to the disclosure of plaintext via chosen-ciphertext attack. - CVE-2018-5185 (information disclosure) A security issue has been found in Thunderbird before 52.8, where plaintext of decrypted emails can leak through by user submitting an embedded form. Impact ====== A remote attacker might be able to access sensitive information via a crafted encrypted e-mail, and spoof the name of an attachment. A remote attacker might also be able to access sensitive information, crash the process or execute arbitrary code via a crafted HTML e-mail if viewing HTML messages is enabled. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%... https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154 https://bugzilla.mozilla.org/show_bug.cgi?id=1443092 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155 https://bugzilla.mozilla.org/show_bug.cgi?id=1448774 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159 https://bugzilla.mozilla.org/show_bug.cgi?id=1441941 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161 https://bugzilla.mozilla.org/show_bug.cgi?id=1411720 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162 https://bugzilla.mozilla.org/show_bug.cgi?id=1457721 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168 https://bugzilla.mozilla.org/show_bug.cgi?id=1449548 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170 https://bugzilla.mozilla.org/show_bug.cgi?id=1411732 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178 https://bugzilla.mozilla.org/show_bug.cgi?id=1443891 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183 https://bugzilla.mozilla.org/show_bug.cgi?id=1454692 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184 https://bugzilla.mozilla.org/show_bug.cgi?id=1411592 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185 https://bugzilla.mozilla.org/show_bug.cgi?id=1450345 https://security.archlinux.org/CVE-2018-5150 https://security.archlinux.org/CVE-2018-5154 https://security.archlinux.org/CVE-2018-5155 https://security.archlinux.org/CVE-2018-5159 https://security.archlinux.org/CVE-2018-5161 https://security.archlinux.org/CVE-2018-5162 https://security.archlinux.org/CVE-2018-5168 https://security.archlinux.org/CVE-2018-5170 https://security.archlinux.org/CVE-2018-5178 https://security.archlinux.org/CVE-2018-5183 https://security.archlinux.org/CVE-2018-5184 https://security.archlinux.org/CVE-2018-5185