[manjaro-security] [ASA-201805-21] thunderbird: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201805-21
==========================================

Severity: Critical
Date    : 2018-05-21
CVE-ID  : CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5159
          CVE-2018-5161 CVE-2018-5162 CVE-2018-5168 CVE-2018-5170
          CVE-2018-5178 CVE-2018-5183 CVE-2018-5184 CVE-2018-5185
Package : thunderbird
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-707

Summary
=======

The package thunderbird before version 52.8.0-1 is vulnerable to
multiple issues including arbitrary code execution, information
disclosure, access restriction bypass, content spoofing and denial of
service.

Resolution
==========

Upgrade to 52.8.0-1.

# pacman -Syu "thunderbird>=52.8.0-1"

The problems have been fixed upstream in version 52.8.0.

Workaround
==========

Most of these issues can be mitigated by viewing e-mails in plain text
mode, via the "View",  "Message Body As", "Plain Text" menus.

Description
===========

- CVE-2018-5150 (arbitrary code execution)

Several memory safety bugs have been found in Firefox before 60.0 and
Thunderbird before 52.8. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could be exploited to run arbitrary code.

- CVE-2018-5154 (arbitrary code execution)

A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while enumerating attributes during SVG animations
with clip paths.

- CVE-2018-5155 (arbitrary code execution)

A use-after-free vulnerability has been found in Firefox < 60.0 and
Thunderbird < 52.8, while adjusting layout during SVG animations with
text paths.

- CVE-2018-5159 (arbitrary code execution)

An integer overflow vulnerability has been found in the Skia library
used in Firefox < 60.0 and Thunderbird < 52.8, due to 32-bit integer
use in an array without integer overflow checks, resulting in possible
out-of-bounds writes. This could lead to a potentially exploitable
crash triggerable by web content.

- CVE-2018-5161 (denial of service)

A security issue has been found in Thunderbird before 52.8, where
crafted message headers can cause a Thunderbird process to hang on
receiving the message.

- CVE-2018-5162 (information disclosure)

A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through the src attribute of
remote images, or links.

- CVE-2018-5168 (access restriction bypass)

Sites can bypass security checks on permissions to install lightweight
themes in Firefox before 60.0 and Thunderbird before 52.8, by
manipulating the baseURI property of the theme element. This could
allow a malicious site to install a theme without user interaction
which could contain offensive or embarrassing images.

- CVE-2018-5170 (content spoofing)

It is possible in Thunderbird before 52.8 to spoof the filename of an
attachment and display an arbitrary attachment name. This could lead to
a user opening a remote attachment which is a different file type than
expected.

- CVE-2018-5178 (information disclosure)

A buffer overflow was found in Thunderbird before 52.8, during UTF8 to
Unicode string conversion within JavaScript with extremely large
amounts of data. This vulnerability requires the use of a malicious or
vulnerable legacy extension in order to occur.

- CVE-2018-5183 (arbitrary code execution)

Several memory corruption issues including invalid buffer reads and
writes during graphic operations have been found in the Skia library.

- CVE-2018-5184 (information disclosure)

A security issue has been found in Thunderbird before 52.8, where using
remote content in S/MIME encrypted messages can lead to the disclosure
of plaintext via chosen-ciphertext attack.

- CVE-2018-5185 (information disclosure)

A security issue has been found in Thunderbird before 52.8, where
plaintext of decrypted emails can leak through by user submitting an
embedded form.

Impact
======

A remote attacker might be able to access sensitive information via a
crafted encrypted e-mail, and spoof the name of an attachment. A remote
attacker might also be able to access sensitive information, crash the
process or execute arbitrary code via a crafted HTML e-mail if viewing
HTML messages is enabled.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154
https://bugzilla.mozilla.org/show_bug.cgi?id=1443092
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155
https://bugzilla.mozilla.org/show_bug.cgi?id=1448774
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159
https://bugzilla.mozilla.org/show_bug.cgi?id=1441941
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161
https://bugzilla.mozilla.org/show_bug.cgi?id=1411720
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162
https://bugzilla.mozilla.org/show_bug.cgi?id=1457721
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168
https://bugzilla.mozilla.org/show_bug.cgi?id=1449548
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170
https://bugzilla.mozilla.org/show_bug.cgi?id=1411732
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178
https://bugzilla.mozilla.org/show_bug.cgi?id=1443891
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183
https://bugzilla.mozilla.org/show_bug.cgi?id=1454692
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184
https://bugzilla.mozilla.org/show_bug.cgi?id=1411592
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185
https://bugzilla.mozilla.org/show_bug.cgi?id=1450345
https://security.archlinux.org/CVE-2018-5150
https://security.archlinux.org/CVE-2018-5154
https://security.archlinux.org/CVE-2018-5155
https://security.archlinux.org/CVE-2018-5159
https://security.archlinux.org/CVE-2018-5161
https://security.archlinux.org/CVE-2018-5162
https://security.archlinux.org/CVE-2018-5168
https://security.archlinux.org/CVE-2018-5170
https://security.archlinux.org/CVE-2018-5178
https://security.archlinux.org/CVE-2018-5183
https://security.archlinux.org/CVE-2018-5184
https://security.archlinux.org/CVE-2018-5185

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20180525/723a4618/attachment.sig>