Ubuntu update for Thunderbird

1) Protection mechanism failure

EUVDB-ID: #VU22168

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11763

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to the way Firefox processes HTML entities. A remote attacker can create a specially crafted web page and make the browser treat HTML comment text as HTML, which could have led to XSS in a web application.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU22173

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11764

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU21091

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-15903

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing XML documents within the expat library. A remote attacker can create a specially crafted XML file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the affected application.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU22167

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11762

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Firefox processes two same-origin documents that set document.domain differently to become cross-origin. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information, as it is possible to call arbitrary DOM methods/getters/setters on the now-cross-origin window.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU22166

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11761

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the application allows access to a privileged JSONView object that had been cloned into content. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU22163

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11757

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when storing a value in IndexedDB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU22174

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11758

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content with installed 360 Total Security. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stack-based buffer overflow

EUVDB-ID: #VU22164

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11759

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing HMAC data. A remote attacker can create a specially crafted web page that causes 4 bytes of HMAC output to be written past the end of a buffer stored on the stack, trick the victim into visiting it and crash the application.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Stack-based buffer overflow

EUVDB-ID: #VU22165

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-11760

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in nrappkit when doing WebRTC signaling. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Spoofing attack

EUVDB-ID: #VU21371

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11755

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of S/MIME messages, consisting of an inner encryption layer and an outer SignedData layeruser-supplied data. A remote attacker can create a specially crafted message and make it look as it was signed with a valid signature. Although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message.

Mitigation

Update the affected packages.

Ubuntu 19.10: thunderbird - 1:68.2.1+build1-0ubuntu0.19.10.1
Ubuntu 18.04 LTS: thunderbird - 1:68.2.1+build1-0ubuntu0.18.04.1

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.2.0+build1.1-0ubuntu3

CPE2.3

External links

https://usn.ubuntu.com/4202-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2019-11763 CVE-2019-11764 CVE-2019-15903 CVE-2019-11762 CVE-2019-11761 CVE-2019-11757 CVE-2019-11758 CVE-2019-11759 CVE-2019-11760 CVE-2019-11755
CWE-ID	CWE-693 CWE-119 CWE-125 CWE-264 CWE-416 CWE-121 CWE-451
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software	thunderbird (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.