Alpine: thunderbird: security update to 68.5.0-r0

high Tenable Cloud Security Plugin ID 407338

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR
68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some
of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited
through email in the Thunderbird product because scripting is disabled when reading mail, but are
potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5,
Firefox < 73, and Firefox < ESR68.5. (CVE-2020-6800)

- When deriving an identifier for an email message, uninitialized memory was used in addition to the message
contents. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6792)

- When processing an email message with an ill-formed envelope, Thunderbird could read data from a random
memory location. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6793)

- If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy
of these passwords is still accessible. This is because the older stored password file was not deleted
when the data was copied to a new format starting in Thunderbird 60. The new master password is added only
on the new file. This could allow the exposure of stored password data outside of user expectations. This
vulnerability affects Thunderbird < 68.5. (CVE-2020-6794)

- When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code
caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects
Thunderbird < 68.5. (CVE-2020-6795)

Plugin Details

Severity: High

ID: 407338

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-6800

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/11/2020

Reference Information

CVE: CVE-2020-6792, CVE-2020-6793, CVE-2020-6794, CVE-2020-6795, CVE-2020-6797, CVE-2020-6798, CVE-2020-6800

IAVA: 2020-A-0072-S

Detections

Analytics