Ubuntu update for Thunderbird

1) Use-after-free

EUVDB-ID: #VU22163

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11757

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when storing a value in IndexedDB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU23050

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11745

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the NSC_EncryptUpdate() function in /lib/softoken/pkcs11c.c, when performing padding operations in Mozilla NSS. A remote attacker can pass specially crafted data to the affected application, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU25851

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6807

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in cubeb during stream destruction. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU25857

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6812

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU25859

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6814

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU26573

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2020-6819

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by a race condition running the nsDocShell destructor. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, this vulnerability is being actively exploited in the wild in targeted attacks.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

7) Use-after-free

EUVDB-ID: #VU26574

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2020-6820

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by a race condition handling ReadableStream. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, this vulnerability is being actively exploited in the wild in targeted attacks.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

8) Out-of-bounds read

EUVDB-ID: #VU26649

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6821

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when using WebGL copyTexSubImage method. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read contents of uninitialized memory on the system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU26653

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6825

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Spoofing attack

EUVDB-ID: #VU21371

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11755

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of S/MIME messages, consisting of an inner encryption layer and an outer SignedData layeruser-supplied data. A remote attacker can create a specially crafted message and make it look as it was signed with a valid signature. Although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted message.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU25849

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6805

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when removing data about origins in Quota manager in Mozilla Firefox. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU21091

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-15903

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing XML documents within the expat library. A remote attacker can create a specially crafted XML file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the affected application.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Use of insufficiently random values

EUVDB-ID: #VU25129

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6792

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to an error in the message ID calculation processes that used uninitialized data in addition to the message contents.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU25126

Risk: Medium

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6793

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing email messages. A remote attacker can send a specially crafted email message to the victim, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system or crash the application.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU25128

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6795

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing messages with multiple S/MIME signatures. A remote attacker can send a specially crafted email message tho the victim and crash the application.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds write

EUVDB-ID: #VU26650

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6822

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary condition in GMPDecodeData when processing images larger than 4Gb on 32-bit builds. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Cleartext storage of sensitive information

EUVDB-ID: #VU25127

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6794

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an error password management functionality when working with master password that was updated after Thunderbird 60 release. The old password is still available unencrypted on the system, as Thunderbird did not delete the old password file after update.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Input validation error

EUVDB-ID: #VU25855

Risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6811

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary OS commands.

The vulnerability exists due to insufficient validation of user-supplied input copied into buffer via the 'Copy as cURL' feature of Devtools' network tab. A remote attacker can trick the victim into using the 'Copy as cURL' feature to copy malicious data into buffer and later insert them into a terminal window.

Successful exploitation of the vulnerability may result in OS command execution.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Out-of-bounds read

EUVDB-ID: #VU25850

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6806

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to an out-of-bounds read error due to BodyStream::OnInputStreamReady was missing protections against state confusion. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Memory corruption

EUVDB-ID: #VU25124

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6800

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU22174

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11758

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content with installed 360 Total Security. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU23370

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17008

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error during worker destruction. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and crash the application or execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Stack-based buffer overflow

EUVDB-ID: #VU22164

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11759

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing HMAC data. A remote attacker can create a specially crafted web page that causes 4 bytes of HMAC output to be written past the end of a buffer stored on the stack, trick the victim into visiting it and crash the application.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Stack-based buffer overflow

EUVDB-ID: #VU22165

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-11760

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in nrappkit when doing WebRTC signaling. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU22166

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11761

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the application allows access to a privileged JSONView object that had been cloned into content. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU22167

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11762

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Firefox processes two same-origin documents that set document.domain differently to become cross-origin. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information, as it is possible to call arbitrary DOM methods/getters/setters on the now-cross-origin window.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Protection mechanism failure

EUVDB-ID: #VU22168

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11763

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to the way Firefox processes HTML entities. A remote attacker can create a specially crafted web page and make the browser treat HTML comment text as HTML, which could have led to XSS in a web application.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Buffer overflow

EUVDB-ID: #VU22173

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11764

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Buffer overflow

EUVDB-ID: #VU23375

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17005

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a memory corruption in plain text serializer. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Use-after-free

EUVDB-ID: #VU23374

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17010

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when checking the Resist Fingerprinting preference during device orientation checks. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a race condition that will results in a use-after-free error.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Code Injection

EUVDB-ID: #VU25122

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6798

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code on the target system.

The vulnerability exists due to improper input validation when parsing template tag. A remote attacker can confuse the JavaScript parser into executing an arbitrary JavaScript send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Use-after-free

EUVDB-ID: #VU23376

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17011

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when retrieving a document from a DocShell in the antitracking code. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a race condition that will results in a use-after-free error.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Buffer overflow

EUVDB-ID: #VU23377

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17012

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a memory corruption when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Code Injection

EUVDB-ID: #VU24054

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17016

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation when pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Type Confusion

EUVDB-ID: #VU24055

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17017

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing HTML content in XPCVariant.cpp. A remote attacker can create a specially crated web page, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Cross-site scripting

EUVDB-ID: #VU24060

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17022

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the CSS sanitizer. When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. If a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Buffer overflow

EUVDB-ID: #VU24062

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-17024

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Type Confusion

EUVDB-ID: #VU24147

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2019-17026

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error with StoreElementHole and FallibleStoreElement when processing HTML content in IonMonkey JIT compiler. A remote attacker can create a specially crafted webpage, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

39) Out-of-bounds read

EUVDB-ID: #VU25856

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20503

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in sctp_load_addresses_from_init in usrsctp. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected packages.

Ubuntu 16.04 LTS: thunderbird - 1:68.7.0+build1-0ubuntu0.16.04.2

Vulnerable software versions

thunderbird (Ubuntu package): 1:68.0+build6-0ubuntu1 - 1:68.7.0+build1-0ubuntu1

CPE2.3

External links

https://usn.ubuntu.com/4335-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Critical
Patch available	YES
Number of vulnerabilities	39
CVE-ID	CVE-2019-11757 CVE-2019-11745 CVE-2020-6807 CVE-2020-6812 CVE-2020-6814 CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 CVE-2020-6825 CVE-2019-11755 CVE-2020-6805 CVE-2019-15903 CVE-2020-6792 CVE-2020-6793 CVE-2020-6795 CVE-2020-6822 CVE-2020-6794 CVE-2020-6811 CVE-2020-6806 CVE-2020-6800 CVE-2019-11758 CVE-2019-17008 CVE-2019-11759 CVE-2019-11760 CVE-2019-11761 CVE-2019-11762 CVE-2019-11763 CVE-2019-11764 CVE-2019-17005 CVE-2019-17010 CVE-2020-6798 CVE-2019-17011 CVE-2019-17012 CVE-2019-17016 CVE-2019-17017 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 CVE-2019-20503
CWE-ID	CWE-416 CWE-787 CWE-200 CWE-119 CWE-125 CWE-451 CWE-330 CWE-476 CWE-312 CWE-20 CWE-121 CWE-264 CWE-693 CWE-94 CWE-843 CWE-79
Exploitation vector	Network
Public exploit	Vulnerability #6 is being exploited in the wild. Vulnerability #7 is being exploited in the wild. Public exploit code for vulnerability #12 is available. Vulnerability #38 is being exploited in the wild.
Vulnerable software	thunderbird (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.