Amazon Linux 2 : thunderbird (ALAS-2020-1429)

critical Nessus Plugin ID 136752
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The Mozilla Foundation Security Advisory describes this flaw as :

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in 'GMPDecodeData'. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6822)

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-6831)

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
(CVE-2020-6819)

The Mozilla Foundation Security Advisory describes this flaw as :

Mozilla developers reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
(CVE-2020-6825)

The Mozilla Foundation Security Advisory describes this flaw as :

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

When reading from areas partially or fully outside the source resource with WebGL's 'copyTexSubImage' method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
(CVE-2020-6821)

Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)

Memory safety flaws were found in Mozilla Firefox and Thunderbird.
Memory corruption that an attacker could leverage with enough effort, could allow arbitrary code to run. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-12395)

A flaw was found in Mozilla Firefox and Thunderbird. When running shutdown code for Web Worker, a race condition occurs leading to a use-after-free memory flaw that could lead to an exploitable crash.
The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-12387)

Solution

Run 'yum update thunderbird' to update your system.

See Also

https://alas.aws.amazon.com/AL2/ALAS-2020-1429.html

Plugin Details

Severity: Critical

ID: 136752

File Name: al2_ALAS-2020-1429.nasl

Version: 1.8

Type: local

Agent: unix

Published: 5/21/2020

Updated: 11/30/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2020-12395

VPR

Risk Factor: Critical

Score: 9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:thunderbird, p-cpe:/a:amazon:linux:thunderbird-debuginfo, cpe:/o:amazon:linux:2

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/20/2020

Vulnerability Publication Date: 4/24/2020

Reference Information

CVE: CVE-2020-12387, CVE-2020-12392, CVE-2020-12395, CVE-2020-12397, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6822, CVE-2020-6825, CVE-2020-6831

ALAS: 2020-1429

IAVA: 2020-A-0190-S