The version of Mozilla Thunderbird installed on the remote Windows host is prior to 60.0. It is, therefore, affected by multiple vulnerabilities.

This update for MozillaFirefox to version ESR 52.9 fixes the following issues :

CVE-2018-5188: Various memory safety bugs (bsc#1098998)

CVE-2018-12368: No warning when opening executable SettingContent-ms files

CVE-2018-12366: Invalid data handling during QCMS transformations

CVE-2018-12365: Compromised IPC child process can list local filenames

CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins

CVE-2018-12363: Use-after-free when appending DOM nodes

CVE-2018-12362: Integer overflow in SSSE3 scaler

CVE-2018-12360: Use-after-free when using focus()

CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture

CVE-2018-12359: Buffer overflow using computed size of canvas element

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues.

Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts :

  - CVE-2018-12377: Use-after-free in refresh driver timers     (bsc#1107343)

  - CVE-2018-12378: Use-after-free in IndexedDB     (bsc#1107343)

  - CVE-2017-16541: Proxy bypass using automount and autofs     (bsc#1066489)

  - CVE-2018-12376: Memory safety bugs fixed in Firefox 62     and Firefox ESR 60.2 (bsc#1107343)

  - CVE-2018-12385: Crash in TransportSecurityInfo due to     cached data (bsc#1109363)

  - CVE-2018-12383: Setting a master password did not delete     unencrypted previously stored passwords (bsc#1107343)

  - CVE-2018-12359: Buffer overflow using computed size of     canvas element (bsc#1098998)

  - CVE-2018-12360: Use-after-free when using focus()     (bsc#1098998)

  - CVE-2018-12361: Integer overflow in SwizzleData     (bsc#1098998)

  - CVE-2018-12362: Integer overflow in SSSE3 scaler     (bsc#1098998)

  - CVE-2018-12363: Use-after-free when appending DOM nodes     (bsc#1098998)

  - CVE-2018-12364: CSRF attacks through 307 redirects and     NPAPI plugins (bsc#1098998)

  - CVE-2018-12365: Compromised IPC child process can list     local filenames (bsc#1098998)

  - CVE-2018-12371: Integer overflow in Skia library during     edge builder allocation (bsc#1098998)

  - CVE-2018-12366: Invalid data handling during QCMS     transformations (bsc#1098998)

  - CVE-2018-12367: Timing attack mitigation of     PerformanceNavigationTiming (bsc#1098998)

  - CVE-2018-5156: Media recorder segmentation fault when     track type is changed during capture (bsc#1098998)

  - CVE-2018-5187: Memory safety bugs fixed in Firefox 61,     Firefox ESR 60.1, and Thunderbird 60 (bsc#1098998)

  - CVE-2018-5188: Memory safety bugs fixed in Firefox 61,     Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60     (bsc#1098998)

Other bugs fixes :

  - Fix date display issues (bsc#1109379)

  - Fix start-up crash due to folder name with special     characters (bsc#1107772)

Versions of Mozilla Firefox ESR earlier than 60.1 are unpatched for the following vulnerabilities :

 - An out-of-bounds read flaw exists in the 'qcms_modular_transform_data()' function in 'chain.c' that is triggered when handling an invalid grid size during QCMS transformations. This may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in 'dom/performance/PerformanceNavigationTiming.cpp' that is triggered as the Navigation APIs can be used as a precision timer. This may allow a context-dependent attacker to conduct timing attacks.
 - A flaw exists in the 'nsLocalFile::IsExecutable()' function in 'xpcom/io/nsLocalFileWin.cpp', as 'settingcontent-ms' is not recognized as an executable file extension. This may allow a context-dependent attacker to more easily trick a user into opening a malicious file without a warning prompt being presented.
 - A flaw exists in the WebExtension that is triggered as embedded experiments are not properly checked. This may allow a context-dependent attacker to bypass authorization mechanisms.
 - An integer overflow flaw exists that is triggered as uninitialized memory is used when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ContentParent::RecvGetFilesRequest()' function in 'dom/ipc/ContentParent.cpp'. Combined with another vulnerability this may allow a context-dependent attacker to bypass the sandbox and enumerate file names.
 - An overflow condition exists in the 'CanvasRenderingContext2D::SetDimensions()' function in 'dom/canvas/CanvasRenderingContext2D.cpp' that is triggered when handling '<canvas>' element dimensions. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists in the 'HTMLInputElement::Focus()' function in 'dom/html/HTMLInputElement.cpp' that is triggered when deleting input elements during a mutation event handler. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An integer overflow condition exists in 'gfx/2d/ssse3-scaler.c' within the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler that is triggered when handling graphics operations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists that is triggered when capturing a media stream and the media source type is changed. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when using scripts to perform mutations to move DOM nodes between documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists when handling 307 redirects as HTTP requests to NPAPI plugins do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to perform unspecified actions.
 - An unspecified flaw exists in 'netwerk/sctp/datachannel/DataChannel.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds access flaw exists in 'webrtc/modules/video_coding/rtp_frame_reference_finder.cc' that is triggered as certain input is not properly validated when handling VP9 missing frame processing. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'js/src/gc/GC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/ds/Observer.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'js/src/frontend/BytecodeEmitter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GCMarker::markDelayedChildren()' function in 'js/src/gc/Marking.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsMozIconURI::Deserialize()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when managing physical audio devices. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'FromIPCSegment()' function in 'netwerk/base/nsStandardURL.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/StructuredCloneHolder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'JS::Rooted()' function in 'dom/xbl/nsXBLBinding.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/canvas/WebGLContextDraw.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/media/PeerConnection.js' that is triggered when handling ICE connection state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'hal/Hal.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

 - Mutliple vulnerabilities in the following may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code:
 - 'netwerk/sctp/datachannel/DataChannel.cpp'
 - 'xpcom/ds/Observer.h'
 - 'js/src/frontend/BytecodeEmitter.cpp'
 - 'nsMozIconURI::Deserialize()'
 - 'dom/base/StructuredCloneHolder.cpp'
 - 'dom/xbl/nsXBLBinding.cpp'
 - 'dom/canvas/WebGLContextDraw.cpp'
 - 'dom/media/PeerConnection.js'
 - 'hal/Hal.cpp'

Versions of Mozilla Firefox earlier than 61 are unpatched for the following vulnerabilities :

 - An out-of-bounds read flaw exists in the 'qcms_modular_transform_data()' function in 'chain.c' that is triggered when handling an invalid grid size during QCMS transformations. This may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in 'dom/performance/PerformanceNavigationTiming.cpp' that is triggered as the Navigation APIs can be used as a precision timer. This may allow a context-dependent attacker to conduct timing attacks.
 - A flaw exists in the 'nsLocalFile::IsExecutable()' function in 'xpcom/io/nsLocalFileWin.cpp', as 'settingcontent-ms' is not recognized as an executable file extension. This may allow a context-dependent attacker to more easily trick a user into opening a malicious file without a warning prompt being presented.
 - A flaw exists in the WebExtension that is triggered as embedded experiments are not properly checked. This may allow a context-dependent attacker to bypass authorization mechanisms.
 - An integer overflow flaw exists that is triggered as uninitialized memory is used when allocating memory for edge builders. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ContentParent::RecvGetFilesRequest()' function in 'dom/ipc/ContentParent.cpp'. Combined with another vulnerability this may allow a context-dependent attacker to bypass the sandbox and enumerate file names.
 - An overflow condition exists in the 'CanvasRenderingContext2D::SetDimensions()' function in 'dom/canvas/CanvasRenderingContext2D.cpp' that is triggered when handling '<canvas>' element dimensions. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists in the 'HTMLInputElement::Focus()' function in 'dom/html/HTMLInputElement.cpp' that is triggered when deleting input elements during a mutation event handler. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered during the handling of a redirection initiated by a service worker. This may allow a context-dependent attacker to bypass the same-origin policy.
 - An integer overflow condition exists in 'gfx/2d/ssse3-scaler.c' within the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler that is triggered when handling graphics operations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists that is triggered when capturing a media stream and the media source type is changed. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when using scripts to perform mutations to move DOM nodes between documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists when handling 307 redirects as HTTP requests to NPAPI plugins do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to perform unspecified actions.
 - A flaw exists in 'toolkit/components/reader/ReaderMode.jsm' that is triggered as SameSite cookie protections are not properly checked when exiting Reader View. This may allow a context-dependent attacker to bypass CSRF protection mechanisms.
 - A use-after-free error exists in the 'Debugger::findZoneEdges()' function in 'js/src/vm/Debugger.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/vr/ipc/VRManagerChild.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'gfxFontUtils::MapCharToGlyphFormat4()' function in 'gfx/thebes/gfxFontUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'ExecuteServiceCommand()' function in 'toolkit/components/maintenanceservice/workmonitor.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'netwerk/sctp/datachannel/DataChannel.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An out-of-bounds access flaw exists in 'webrtc/modules/video_coding/rtp_frame_reference_finder.cc' that is triggered as certain input is not properly validated when handling VP9 missing frame processing. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A race condition exists in 'js/src/gc/GC.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/ds/Observer.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'js/src/frontend/BytecodeEmitter.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GCMarker::markDelayedChildren()' function in 'js/src/gc/Marking.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'nsMozIconURI::Deserialize()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when managing physical audio devices. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'FromIPCSegment()' function in 'netwerk/base/nsStandardURL.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/StructuredCloneHolder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'JS::Rooted()' function in 'dom/xbl/nsXBLBinding.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/canvas/WebGLContextDraw.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/media/PeerConnection.js' that is triggered when handling ICE connection state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'hal/Hal.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

Versions of Mozilla Firefox ESR earlier than 52.9 are unpatched for the following vulnerabilities :

 - An out-of-bounds read flaw exists in the 'qcms_modular_transform_data()' function in 'chain.c' that is triggered when handling an invalid grid size during QCMS transformations. This may allow a context-dependent attacker to potentially disclose memory contents.
 - A flaw exists in the 'nsLocalFile::IsExecutable()' function in 'xpcom/io/nsLocalFileWin.cpp', as 'settingcontent-ms' is not recognized as an executable file extension. This may allow a context-dependent attacker to more easily trick a user into opening a malicious file without a warning prompt being presented.
 - A flaw exists in the 'ContentParent::RecvGetFilesRequest()' function in 'dom/ipc/ContentParent.cpp'. Combined with another vulnerability this may allow a context-dependent attacker to bypass the sandbox and enumerate file names.
 - An overflow condition exists in the 'CanvasRenderingContext2D::SetDimensions()' function in 'dom/canvas/CanvasRenderingContext2D.cpp' that is triggered when handling '<canvas>' element dimensions. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A use-after-free error exists in the 'HTMLInputElement::Focus()' function in 'dom/html/HTMLInputElement.cpp' that is triggered when deleting input elements during a mutation event handler. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An integer overflow condition exists in 'gfx/2d/ssse3-scaler.c' within the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler that is triggered when handling graphics operations. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists that is triggered when capturing a media stream and the media source type is changed. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when using scripts to perform mutations to move DOM nodes between documents. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists when handling 307 redirects as HTTP requests to NPAPI plugins do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to perform unspecified actions.
 - An unspecified flaw exists in the 'nsMozIconURI::Deserialize()' function in 'image/decoders/icon/nsIconURI.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when managing physical audio devices. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'FromIPCSegment()' function in 'netwerk/base/nsStandardURL.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/base/StructuredCloneHolder.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the 'JS::Rooted()' function in 'dom/xbl/nsXBLBinding.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/canvas/WebGLContextDraw.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'dom/media/PeerConnection.js' that is triggered when handling ICE connection state changes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'hal/Hal.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

 - Mutliple vulnerabilities in the following may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code:
 - 'nsMozIconURI::Deserialize()'
 - 'dom/base/StructuredCloneHolder.cpp'
 - 'dom/xbl/nsXBLBinding.cpp'
 - 'dom/canvas/WebGLContextDraw.cpp'
 - 'dom/media/PeerConnection.js'
 - 'hal/Hal.cpp'

ID	Name	Product	Family	Published	Updated	Severity
111981	Mozilla Thunderbird < 60.0 Multiple Vulnerabilities	Nessus	Windows	8/20/2018	8/16/2024	critical
118279	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2018:2322-2)	Nessus	SuSE Local Security Checks	10/22/2018	7/30/2024	critical
123293	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-680)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	critical
700341	Mozilla Firefox ESR < 60.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2018	11/6/2019	high
700330	Mozilla Firefox < 61 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2018	3/6/2019	high
700339	Mozilla Firefox ESR < 52.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/21/2018	11/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

high

high