Ubuntu update for Thunderbird



Published: 2019-03-28 | Updated: 2023-04-27
Risk High
Patch available YES
Number of vulnerabilities 10
CVE-ID CVE-2018-18506
CVE-2019-9788
CVE-2019-9790
CVE-2019-9791
CVE-2019-9792
CVE-2019-9795
CVE-2019-9796
CVE-2019-9810
CVE-2019-9813
CVE-2019-9793
CWE-ID CWE-200
CWE-119
CWE-416
CWE-843
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Public exploit code for vulnerability #5 is available.
Vulnerability #8 is being exploited in the wild.
Public exploit code for vulnerability #9 is available.
Vulnerable software
Subscribe 		thunderbird (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU17264

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-18506

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in proxy support implementation. When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing.

A remote attacker can trick the victim to visit a specially crafted website and gain unauthorized access to services or resources, exposed on user's system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU18048

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9788

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple boundary errors when processing HTML content. A remote attacker trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU18029

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9790

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Type confusion

EUVDB-ID: #VU18030

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9791

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a type confusion error within the type inference system. The system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Memory corruption

EUVDB-ID: #VU18031

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9792

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the IonMonkey just-in-time (JIT) compiler that leaks an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Type confusion

EUVDB-ID: #VU18034

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9795

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a type confusion error within the IonMonkey just-in-time (JIT) compiler. A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU18035

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9796

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the SMIL animation controller. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU18061

Risk: High

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2019-9810

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing incorrect information alias in IonMonkey JIT compiler for Array.prototype.slice method. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

9) Type Confusion

EUVDB-ID: #VU18062

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9813

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when handling proto mutations in IonMonkey JIT code. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

10) Memory corruption

EUVDB-ID: #VU18032

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9793

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to missing boundary checks for strings, arrays or typed arrays when the default Spectre mitigations have been disabled. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system but requires the user to specifically disable Spectre mitigations.

Mitigation

Update the affected packages.

Ubuntu 18.10
thunderbird - 1:60.6.1+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
thunderbird - 1:60.6.1+build2-0ubuntu0.14.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:38.5.1+build2-0ubuntu0.14.04.1 - 1:60.5.3+build1-0ubuntu0.18.10.1

External links

http://usn.ubuntu.com/3927-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###