[ASA-201902-23] thunderbird: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-201902-23
==========================================

Severity: Critical
Date    : 2019-02-20
CVE-ID  : CVE-2018-18335 CVE-2018-18356 CVE-2018-18509 CVE-2019-5785
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-908

Summary
=======

The package thunderbird before version 60.5.1-1 is vulnerable to
multiple issues including arbitrary code execution and insufficient
validation.

Resolution
==========

Upgrade to 60.5.1-1.

# pacman -Syu "thunderbird>=60.5.1-1"

The problems have been fixed upstream in version 60.5.1.

Workaround
==========

None.

Description
===========

- CVE-2018-18335 (arbitrary code execution)

A heap-based buffer overflow has been found in the Skia component of
chromium before 71.0.3578.80 and thunderbird before 60.5.1.

- CVE-2018-18356 (arbitrary code execution)

A use-after-free has been found in the Skia component of chromium
before 71.0.3578.80 and firefox before 65.0.1 and thunderbird before
60.5.1.

- CVE-2018-18509 (insufficient validation)

A flaw during verification of certain S/MIME signatures causes emails
to be shown in Thunderbird before 60.5.1 as having a valid digital
signature, even if the shown message contents aren't covered by the
signature. The flaw allows an attacker to reuse a valid S/MIME
signature to craft an email message with arbitrary content.

- CVE-2019-5785 (arbitrary code execution)

An integer overflow issue has been found in the Skia component of
firefox before 65.0.1 and thunderbird before 60.5.1.

Impact
======

A remote attacker can reuse a valid S/MIME signature to craft an e-mail
message with arbitrary content, and execute arbitrary code through
skia.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail?id=895362
https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18335
https://bugzilla.mozilla.org/show_bug.cgi?id=1525815
https://bugs.chromium.org/p/chromium/issues/detail?id=883666
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-18356
https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18356
https://bugzilla.mozilla.org/show_bug.cgi?id=1525817
https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18509
https://bugzilla.mozilla.org/show_bug.cgi?id=1507218
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785
https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2019-5785
https://bugzilla.mozilla.org/show_bug.cgi?id=1525433
https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html
https://security.archlinux.org/CVE-2018-18335
https://security.archlinux.org/CVE-2018-18356
https://security.archlinux.org/CVE-2018-18509
https://security.archlinux.org/CVE-2019-5785
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190226/5528f4f1/attachment.sig>