Arch Linux update for thunderbird

Published: 2019-04-06 | Updated: 2023-04-27

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-9810 CVE-2019-9813
CWE-ID	CWE-119 CWE-843
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Arch Linux Operating systems & Components / Operating system
Vendor	Arch Linux

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU18061

Risk: High

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2019-9810

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing incorrect information alias in IonMonkey JIT compiler for Array.prototype.slice method. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package thunderbird to version 60.6.1-1.

Vulnerable software versions

Arch Linux: All versions

External links

http://security.archlinux.org/advisory/ASA-201904-4

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Type Confusion

EUVDB-ID: #VU18062