Arch Linux Security Advisory ASA-202001-4 ========================================= Severity: Critical Date : 2020-01-14 CVE-ID : CVE-2019-17016 CVE-2019-17017 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1086 Summary ======= The package thunderbird before version 68.4.1-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 68.4.1-1. # pacman -Syu "thunderbird>=68.4.1-1" The problems have been fixed upstream in version 68.4.1. Workaround ========== None. Description =========== - CVE-2019-17016 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. - CVE-2019-17017 (arbitrary code execution) A type confusion issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1, in XPCVariant.cpp where, due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. - CVE-2019-17022 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1 where CSS sanitization does not escape HTML tags. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. - CVE-2019-17024 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0, Firefox ESR before 68.4.1, and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17026 (arbitrary code execution) A type confusion vulnerability has been found in Firefox before 72.0.1, and Thunderbird before 68.4.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker could bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-1701... https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-1701... https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-1702... https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-1702... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%... https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-1702... https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.archlinux.org/CVE-2019-17016 https://security.archlinux.org/CVE-2019-17017 https://security.archlinux.org/CVE-2019-17022 https://security.archlinux.org/CVE-2019-17024 https://security.archlinux.org/CVE-2019-17026