Scientific Linux Security Update : thunderbird on SL7.x x86_64

High Nessus Plugin ID 125716

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Security Fix(es) :

- Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

- Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

- Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

- Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

- Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

- Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

- Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

- Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

- mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

- chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

- Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)

- libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

Solution

Update the affected thunderbird and / or thunderbird-debuginfo packages.

See Also

http://www.nessus.org/u?f213c9a1

Plugin Details

Severity: High

ID: 125716

File Name: sl_20190604_thunderbird_on_SL7_x.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2019/06/05

Updated: 2019/07/26

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2019/06/04

Vulnerability Publication Date: 2019/02/04

Reference Information

CVE: CVE-2018-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11698, CVE-2019-5798, CVE-2019-7317, CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820