Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service via application crash, install lightweight themes without user interaction, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178)

An issue was discovered when processing message headers in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application hang. (CVE-2018-5161)

It was discovered encrypted messages could leak plaintext via the src attribute of remote images or links. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5162)

It was discovered that the filename of an attachment could be spoofed.
An attacker could potentially exploit this by tricking the user in to opening an attachment of a different type to the one expected.
(CVE-2018-5170)

Multiple security issues were discovered in Skia. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2018-5183)

It was discovered that S/MIME encrypted messages with remote content could leak plaintext via a chosen-ciphertext attack. An attacker could potentially exploit this to obtain sensitive information.
(CVE-2018-5184)

It was discovered that plaintext of decrypted emails could leak by submitting an embedded form. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5185).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ubuntu 14.04 LTS / 16.04 LTS / 17.10 / 18.04 LTS : Thunderbird vulnerabilities (USN-3660-1)

critical Nessus Plugin ID 110191

No changelogs found