ArchLinux: 201805-21: thunderbird: multiple issues
Summary
- CVE-2018-5150 (arbitrary code execution)
Several memory safety bugs have been found in Firefox before 60.0 and
Thunderbird before 52.8. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could be exploited to run arbitrary code.
- CVE-2018-5154 (arbitrary code execution)
A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while enumerating attributes during SVG animations
with clip paths.
- CVE-2018-5155 (arbitrary code execution)
A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while adjusting layout during SVG animations with
text paths.
- CVE-2018-5159 (arbitrary code execution)
An integer overflow vulnerability has been found in the Skia library
used in Firefox < 60.0 and Thunderbird < 52.8, due to 32-bit integer
use in an array without integer overflow checks, resulting in possible
out-of-bounds writes. This could lead to a potentially exploitable
crash triggerable by web content.
- CVE-2018-5161 (denial of service)
A security issue has been found in Thunderbird before 52.8, where
crafted message headers can cause a Thunderbird process to hang on
receiving the message.
- CVE-2018-5162 (information disclosure)
A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through the src attribute of
remote images, or links.
- CVE-2018-5168 (access restriction bypass)
Sites can bypass security checks on permissions to install lightweight
themes in Firefox before 60.0 and Thunderbird before 52.8, by
manipulating the baseURI property of the theme element. This could
allow a malicious site to install a theme without user interaction
which could contain offensive or embarrassing images.
- CVE-2018-5170 (content spoofing)
It is possible in Thunderbird before 52.8 to spoof the filename of an
attachment and display an arbitrary attachment name. This could lead to
a user opening a remote attachment which is a different file type than
expected.
- CVE-2018-5178 (information disclosure)
A buffer overflow was found in Thunderbird before 52.8, during UTF8 to
Unicode string conversion within JavaScript with extremely large
amounts of data. This vulnerability requires the use of a malicious or
vulnerable legacy extension in order to occur.
- CVE-2018-5183 (arbitrary code execution)
Several memory corruption issues including invalid buffer reads and
writes during graphic operations have been found in the Skia library.
- CVE-2018-5184 (information disclosure)
A security issue has been found in Thunderbird before 52.8, where using
remote content in S/MIME encrypted messages can lead to the disclosure
of plaintext via chosen-ciphertext attack.
- CVE-2018-5185 (information disclosure)
A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through by user submitting an
embedded form.
Resolution
Upgrade to 52.8.0-1.
# pacman -Syu "thunderbird>=52.8.0-1"
The problems have been fixed upstream in version 52.8.0.
References
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154 https://bugzilla.mozilla.org/show_bug.cgi?id=1443092 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155 https://bugzilla.mozilla.org/show_bug.cgi?id=1448774 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159 https://bugzilla.mozilla.org/show_bug.cgi?id=1441941 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161 https://bugzilla.mozilla.org/show_bug.cgi?id=1411720 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162 https://bugzilla.mozilla.org/show_bug.cgi?id=1457721 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168 https://bugzilla.mozilla.org/show_bug.cgi?id=1449548 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170 https://bugzilla.mozilla.org/show_bug.cgi?id=1411732 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178 https://bugzilla.mozilla.org/show_bug.cgi?id=1443891 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183 https://bugzilla.mozilla.org/show_bug.cgi?id=1454692 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184 https://bugzilla.mozilla.org/show_bug.cgi?id=1411592 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185 https://bugzilla.mozilla.org/show_bug.cgi?id=1450345 https://security.archlinux.org/CVE-2018-5150 https://security.archlinux.org/CVE-2018-5154 https://security.archlinux.org/CVE-2018-5155 https://security.archlinux.org/CVE-2018-5159 https://security.archlinux.org/CVE-2018-5161 https://security.archlinux.org/CVE-2018-5162 https://security.archlinux.org/CVE-2018-5168 https://security.archlinux.org/CVE-2018-5170 https://security.archlinux.org/CVE-2018-5178 https://security.archlinux.org/CVE-2018-5183 https://security.archlinux.org/CVE-2018-5184 https://security.archlinux.org/CVE-2018-5185
Workaround
Most of these issues can be mitigated by viewing e-mails in plain text mode, via the "View", "Message Body As", "Plain Text" menus.
