Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

openSUSE: 2018:1905-1 Moderate: Mozilla Thunderbird Buffer Overflow

opensuse
Calendar Grey July 7, 2018
Scroller Opensuse
This revision resolves various concerns within Mozilla Thunderbird for openSUSE, improving both email confidentiality and security.
An update that fixes 11 vulnerabilities is now available.

Description

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple

issues.

Security issues fixed, inherited from the Mozilla common code base (MFSA

2018-16, bsc#1098998):

- CVE-2018-12359: Buffer overflow using computed size of canvas element

- CVE-2018-12360: Use-after-free when using focus()

- CVE-2018-12362: Integer overflow in SSSE3 scaler

- CVE-2018-12363: Use-after-free when appending DOM nodes

- CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins

- CVE-2018-12365: Compromised IPC child process can list local filenames

- CVE-2018-12366: Invalid data handling during QCMS transformations

- CVE-2018-5188: Memory safety bugs fixed in Thunderbird 52.9.0

Security issues fixed that affect e-mail privacy and integrity (including

EFAIL):

- CVE-2018-12372: S/MIME and PGP decryption oracles can be built with HTML

emails (bsc#1100082)

- CVE-2018-12373: S/MIME plaintext can be leaked through HTML

reply/forward...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security update buffer overflow moderate severity email privacy Mozilla Thunderbird openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-701=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-701=1

Package List

- openSUSE Leap 42.3 (x86_64):

MozillaThunderbird-52.9.0-68.1

MozillaThunderbird-buildsymbols-52.9.0-68.1

MozillaThunderbird-debuginfo-52.9.0-68.1

MozillaThunderbird-debugsource-52.9.0-68.1

MozillaThunderbird-devel-52.9.0-68.1

MozillaThunderbird-translations-common-52.9.0-68.1

MozillaThunderbird-translations-other-52.9.0-68.1

- openSUSE Leap 15.0 (x86_64):

MozillaThunderbird-52.9.0-lp150.3.8.1

MozillaThunderbird-buildsymbols-52.9.0-lp150.3.8.1

MozillaThunderbird-debuginfo-52.9.0-lp150.3.8.1

MozillaThunderbird-debugsource-52.9.0-lp150.3.8.1

MozillaThunderbird-devel-52.9.0-lp150.3.8.1

MozillaThunderbird-translations-common-52.9.0-lp150.3.8.1

MozillaThunderbird-translations-other-52.9.0-lp150.3.8.1

References

https://www.suse.com/security/cve/CVE-2018-12359.html

https://www.suse.com/security/cve/CVE-2018-12360.html

https://www.suse.com/security/cve/CVE-2018-12362.html

https://www.suse.com/security/cve/CVE-2018-12363.html

https://www.suse.com/security/cve/CVE-2018-12364.html

https://www.suse.com/security/cve/CVE-2018-12365.html

https://www.suse.com/security/cve/CVE-2018-12366.html

https://www.suse.com/security/cve/CVE-2018-12372.html

https://www.suse.com/security/cve/CVE-2018-12373.html

https://www.suse.com/security/cve/CVE-2018-12374.html

https://www.suse.com/security/cve/CVE-2018-5188.html

https://bugzilla.suse.com/1076907

https://bugzilla.suse.com/1085780

https://bugzilla.suse.com/1091376

https://bugzilla.suse.com/1098998

https://bugzilla.suse.com/1100079

https://bugzilla.suse.com/1100081

https://bugzilla.suse.com/1100082

--

Announcement ID: openSUSE-SU-2018:1905-1
Rating: moderate
Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0

Topics%20covered

Topics Covered

security advisory security update buffer overflow moderate severity email privacy Mozilla Thunderbird openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.