A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message. Previous versions had only suppressed showing a digital signature for messages with an outer multipart/signed layer. This vulnerability affects Thunderbird < 68.1.1.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4202-1 advisory.

  - A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown     as having a valid digital signature, although the signer might have had no access to the contents of the     encrypted message, and might have stripped a different signature from the encrypted message. Previous     versions had only suppressed showing a digital signature for messages with an outer multipart/signed     layer. This vulnerability affects Thunderbird < 68.1.1. (CVE-2019-11755)

  - When following the value's prototype chain, it was possible to retain a reference to a locale, delete it,     and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This     vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11757)

  - Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total     Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we     presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability     affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11758)

  - An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the     stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This     vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11759)

  - A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a     potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird <     68.2, and Firefox ESR < 68.2. (CVE-2019-11760)

  - By using a form with a data URI it was possible to gain access to the privileged JSONView object that had     been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass     of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and     Firefox ESR < 68.2. (CVE-2019-11761)

  - If two same-origin documents set document.domain differently to become cross-origin, it was possible for     them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability     affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11762)

  - Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly     parsing these entities. This could have led to HTML comment text being treated as HTML which could have     led to XSS in a web application under certain conditions. It could have also led to HTML entities being     masked from filters - enabling the use of entities to mask the actual characters of interest from filters.
    This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11763)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR     68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird <     68.2, and Firefox ESR < 68.2. (CVE-2019-11764)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read. (CVE-2019-15903)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit this to spoof the message author. (CVE-2019-11755)

A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-15903)

It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)

Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)

It was discovered that if a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)

It was discovered that the Devtools' 'Copy as cURL' feature did not fully escape website-controlled data. If a user were tricked in to using the 'Copy as cURL' feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection.
(CVE-2020-6811).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-4202-1 fixed vulnerabilities in Thunderbird. After upgrading, Thunderbird created a new profile for some users. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit this to spoof the message author. (CVE-2019-11755)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764)

A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-15903).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

For Debian 8 'Jessie', these problems have been fixed in version 1:68.2.2-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaThunderbird to version 68.1.1 fixes the following issues :

  - CVE-2019-11709: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11710: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11711: Fixed a script injection within domain     through inner window reuse. (bsc#1140868)

  - CVE-2019-11712: Fixed an insufficient validation of     cross-origin POST requests within NPAPI plugins.
    (bsc#1140868)

  - CVE-2019-11713: Fixed a use-after-free with HTTP/2     cached stream. (bsc#1140868)

  - CVE-2019-11714: Fixed a crash in NeckoChild.
    (bsc#1140868)

  - CVE-2019-11715: Fixed an HTML parsing error that can     contribute to content XSS. (bsc#1140868)

  - CVE-2019-11716: Fixed an enumeration issue in     globalThis. (bsc#1140868)

  - CVE-2019-11717: Fixed an improper escaping of the caret     character in origins. (bsc#1140868)

  - CVE-2019-11719: Fixed an out-of-bounds read when     importing curve25519 private key. (bsc#1140868)

  - CVE-2019-11720: Fixed a character encoding XSS     vulnerability. (bsc#1140868)

  - CVE-2019-11721: Fixed domain spoofing through unicode     latin 'kra' character. (bsc#1140868)

  - CVE-2019-11723: Fixed a cookie leakage during add-on     fetching across private browsing boundaries.
    (bsc#1140868)

  - CVE-2019-11724: Fixed a permissions issue with the     retired site input.mozilla.org. (bsc#1140868)

  - CVE-2019-11725: Fixed a SafeBrowsing bypass through     WebSockets. (bsc#1140868)

  - CVE-2019-11727: Fixed an insufficient validation for     PKCS#1 v1.5 signatures being used with TLS 1.3.
    (bsc#1140868)

  - CVE-2019-11728: Fixed port scanning through Alt-Svc     header. (bsc#1140868)

  - CVE-2019-11729: Fixed a segmentation fault due to empty     or malformed p256-ECDH public keys. (bsc#1140868)

  - CVE-2019-11730: Fixed an insufficient enforcement of the     same-origin policy that treats all files in a directory     as having the same-origin. (bsc#1140868)

  - CVE-2019-11739: Fixed a Covert Content Attack on S/MIME     encryption using a crafted multipart/alternative     message. (bsc#1150939)

  - CVE-2019-11740: Fixed several memory safety bugs.
    (bsc#1149299)

  - CVE-2019-11742: Fixed a same-origin policy violation     with SVG filters and canvas that enabled theft of     cross-origin images. (bsc#1149303)

  - CVE-2019-11743: Fixed a cross-origin access issue.
    (bsc#1149298)

  - CVE-2019-11744: Fixed a XSS involving breaking out of     title and textarea elements using innerHTML.
    (bsc#1149304)

  - CVE-2019-11746: Fixed a use-after-free while     manipulating video. (bsc#1149297)

  - CVE-2019-11752: Fixed a use-after-free while extracting     a key value in IndexedDB. (bsc#1149296)

  - CVE-2019-11755: Fixed an insufficient validation of     S/MIME messages that allowed the author to be spoofed.
    (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

The version of Thunderbird installed on the remote Windows host is prior to 68.1.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-32 advisory.

  - A crafted S/MIME message consisting of an inner     encryption layer and an outer SignedData layer was shown     as having a valid digital signature, although the signer     might have had no access to the contents of the     encrypted message, and might have stripped a different     signature from the encrypted message. Previous versions     had only suppressed showing a digital signature for     messages with an outer multipart/signed layer.
    (CVE-2019-11755)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.1.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-32 advisory.

  - A crafted S/MIME message consisting of an inner     encryption layer and an outer SignedData layer was shown     as having a valid digital signature, although the signer     might have had no access to the contents of the     encrypted message, and might have stripped a different     signature from the encrypted message. Previous versions     had only suppressed showing a digital signature for     messages with an outer multipart/signed layer.
    (CVE-2019-11755)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183628	Ubuntu 18.04 LTS : Thunderbird vulnerabilities (USN-4202-1)	Nessus	Ubuntu Local Security Checks	high
135896	Ubuntu 16.04 LTS : Thunderbird vulnerabilities (USN-4335-1)	Nessus	Ubuntu Local Security Checks	critical
132011	Ubuntu 18.04 LTS : Thunderbird regression (USN-4202-2)	Nessus	Ubuntu Local Security Checks	high
131139	Debian DSA-4571-1 : thunderbird - security update	Nessus	Debian Local Security Checks	high
131136	Debian DLA-1997-1 : thunderbird security update	Nessus	Debian Local Security Checks	high
129663	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2249)	Nessus	SuSE Local Security Checks	critical
129662	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2248)	Nessus	SuSE Local Security Checks	critical
129390	Mozilla Thunderbird < 68.1.1	Nessus	Windows	high
129389	Mozilla Thunderbird < 68.1.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2019-11755

high

Tenable Plugins

high

critical

high

high

high

critical

critical

high

high