This update for MozillaThunderbird to version 68.2.1 provides the following fixes :

  - Security issues fixed (bsc#1154738) :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Other fixes (bsc#1153879) :

  - Some attachments couldn't be opened in messages     originating from MS Outlook 2016.

  - Address book import from CSV.

  - Performance problem in message body search.

  - Ctrl+Enter to send a message would open an attachment if     the attachment pane had focus.

  - Calendar: Issues with 'Today Pane' start-up.

  - Calendar: Glitches with custom repeat and reminder     number input.

  - Calendar: Problems with WCAP provider.

  - A language for the user interface can now be chosen in     the advanced settings 

  - Fixed an issue with Google authentication (OAuth2)

  - Fixed an issue where selected or unread messages were     not shown in the correct color in the thread pane under     some circumstances

  - Fixed an issue where when using a language pack, names     of standard folders were not localized (bsc#1149126)

  - Fixed an issue where the address book default startup     directory in preferences panel not persisted

  - Fixed various visual glitches

  - Fixed issues with the chat

  - Fixed building with rust >= 1.38.

  - Fixrd LTO build without PGO.

  - Removed kde.js since disabling instantApply breaks     extensions and is now obsolete with the move to HTML     views for preferences. (bsc#1151186)

  - Updated create-tar.sh. (bsc#1152778)

  - Deactivated the crashreporter for the last remaining     arch.

This update was imported from the SUSE:SLE-15:Update update project.

An update for thunderbird is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.2.0.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

* Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

* Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

* Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

* Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

* Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

* Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

* Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

* expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4386:06 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)
      * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)
      * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)
      * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)
      * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)
      * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)
      * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)
      * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4378:06 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)
      * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)
      * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)
      * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)
      * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)
      * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)
      * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)
      * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 70.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-34 advisory.

  - Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith,     Christian Holler, Steve Fink, Honza Bambas, Byron Campen, and Cristian Brindusan reported memory safety     bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could be exploited to run arbitrary code.
    (CVE-2019-11764)

  - A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in     arbitrary code execution and a sandbox escape. (CVE-2019-25136)

  - Incorrect derivation of a packet length in WebRTC caused heap corruption via a crafted video file. This     resulted in a potentially exploitable crash. (CVE-2018-6156)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early. A subsequent call to <code>XMLGetCurrentLineNumber</code> or     <code>XMLGetCurrentColumnNumber</code> then resulted in a heap-based buffer over-read. (CVE-2019-15903)

  - When storing a value in IndexedDB, the value's prototype chain is followed and it was possible to retain a     reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a     potentially exploitable crash. (CVE-2019-11757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-35 advisory.

  - Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith,     Christian Holler, Steve Fink, Honza Bambas, Byron Campen, and Cristian Brindusan reported memory safety     bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could be exploited to run arbitrary code.
    (CVE-2019-11764)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early. A subsequent call to <code>XMLGetCurrentLineNumber</code> or     <code>XMLGetCurrentColumnNumber</code> then resulted in a heap-based buffer over-read. (CVE-2019-15903)

  - When following the value's prototype chain, it was possible to retain a reference to a locale, delete it,     and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash.
    (CVE-2019-11757)

  - Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total     Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we     presume that with enough effort that it could be exploited to run arbitrary code. (CVE-2019-11758)

  - An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the     stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash.
    (CVE-2019-11759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3210 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.2.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3281 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.2.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130936	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2452)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	high
130977	CentOS 6 : thunderbird (CESA-2019:3756)	Nessus	CentOS Local Security Checks	11/14/2019	4/11/2024	high
131139	Debian DSA-4571-1 : thunderbird - security update	Nessus	Debian Local Security Checks	11/20/2019	4/11/2024	high
290072	MiracleLinux 4 : firefox-68.2.0-4.0.1.AXS4 (AXSA:2019-4386:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
288923	MiracleLinux 7 : firefox-68.2.0-1.0.1.el7.AXS7 (AXSA:2019-4378:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
130169	Mozilla Firefox < 70.0	Nessus	MacOS X Local Security Checks	10/24/2019	11/18/2025	critical
130364	Mozilla Thunderbird < 68.2	Nessus	MacOS X Local Security Checks	10/29/2019	11/18/2025	high
130371	RHEL 7 : thunderbird (RHSA-2019:3210)	Nessus	Red Hat Local Security Checks	10/30/2019	11/6/2024	high
130444	RHEL 6 : firefox (RHSA-2019:3281)	Nessus	Red Hat Local Security Checks	11/1/2019	11/6/2024	high
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

high

high

critical