Arch Linux Security Advisory ASA-202006-4 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1179 Summary ======= The package thunderbird before version 68.9.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, man-in-the-middle and private key recovery. Resolution ========== Upgrade to 68.9.0-1. # pacman -Syu "thunderbird>=68.9.0-1" The problems have been fixed upstream in version 68.9.0. Workaround ========== None. Description =========== - CVE-2020-12398 (man-in-the-middle) A security downgrade issue has been found in Thunderbird before 68.9.0. If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. - CVE-2020-12399 (private key recovery) NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird before 68.9.0, has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. - CVE-2020-12405 (denial of service) When browsing a malicious page in Firefox before 77.0 and Thunderbird before 68.9.0, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. - CVE-2020-12406 (arbitrary code execution) Mozilla Developer Iain Ireland discovered a missing type check in Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. - CVE-2020-12410 (arbitrary code execution) Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before 68.9.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to recover private keys, downgrade an encrypted connection, execute arbitrary code or crash the application. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/#CVE-2020-1239... https://bugzilla.mozilla.org/show_bug.cgi?id=1613623 https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/ https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429a... https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://security.archlinux.org/CVE-2020-12398 https://security.archlinux.org/CVE-2020-12399 https://security.archlinux.org/CVE-2020-12405 https://security.archlinux.org/CVE-2020-12406 https://security.archlinux.org/CVE-2020-12410