This update for MozillaThunderbird to version 68.7.0 fixes the following issues :

  - CVE-2020-6819: Use-after-free while running the     nsDocShell destructor (boo#1168630)

  - CVE-2020-6820: Use-after-free when handling a     ReadableStream (boo#1168630)

  - CVE-2020-6821: Uninitialized memory could be read when     using the WebGL copyTexSubImage() (boo#1168874)

  - CVE-2020-6822: Out of bounds write in GMPDecodeData when     processing large images (boo#1168874)

  - CVE-2020-6825: Memory safety bugs fixed (boo#1168874)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1488 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819)

    * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820)

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)

    * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)

    * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1496 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819)

    * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820)

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)

    * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)

    * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* Mozilla: Use-after-free while running the nsDocShell destructor * Mozilla: Use-after-free when handling a ReadableStream

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1338 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-4709:03 advisory.

    * Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819)
      * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820)
      * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method     (CVE-2020-6821)
      * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)
      * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
135578	openSUSE Security Update : MozillaThunderbird (openSUSE-2020-520)	Nessus	SuSE Local Security Checks	4/15/2020	12/5/2022	critical
135687	RHEL 6 : thunderbird (RHSA-2020:1488)	Nessus	Red Hat Local Security Checks	4/16/2020	11/7/2024	critical
135691	RHEL 8 : thunderbird (RHSA-2020:1496)	Nessus	Red Hat Local Security Checks	4/16/2020	11/7/2024	critical
135810	Scientific Linux Security Update : firefox on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	4/21/2020	12/6/2022	high
208627	CentOS 7 : firefox (RHSA-2020:1338)	Nessus	CentOS Local Security Checks	10/9/2024	10/10/2024	high
294639	MiracleLinux 4 : thunderbird-68.7.0-1.AXS4 (AXSA:2020-4709:03)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/21/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

high

critical