Alpine: thunderbird: security update to 68.6.0-r0

critical Tenable Self-Hosted Container Security Plugin ID 407339

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs
showed evidence of memory corruption and we presume that with enough effort some of these could have been
exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox <
ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6814)

- usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. (CVE-2019-20503)

- When removing data about an origin whose tab was recently closed, a use-after-free could occur in the
Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird <
68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6805)

- By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of
an array resized during script execution. This could have led to memory corruption and a potentially
exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and
Firefox ESR < 68.6. (CVE-2020-6806)

- When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task
may have been executed after the stream was destroyed, causing a use-after-free and a potentially
exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and
Firefox ESR < 68.6. (CVE-2020-6807)

Plugin Details

Severity: Critical

ID: 407339

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-6814

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 3/6/2020

Reference Information

CVE: CVE-2019-20503, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6811, CVE-2020-6812, CVE-2020-6814

Detections

Analytics