The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Mozilla Thunderbird

vulnerability bulletin CVE-2018-18511

Firefox: information disclosure via ImageBitmapRenderingContext

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via ImageBitmapRenderingContext of Firefox, in order to obtain sensitive information.
Impacted products: Debian, Fedora, Firefox, Thunderbird, openSUSE Leap, Solaris, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 13/02/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-058, CVE-2018-18511, DLA-1800-1, DSA-4448-1, FEDORA-2019-0a381a82de, FEDORA-2019-3b8d06c61e, FEDORA-2019-7ad9201e59, MFSA-2019-04, MFSA-2019-05, MFSA-2019-14, MFSA-2019-15, openSUSE-SU-2019:1484-1, openSUSE-SU-2019:1534-1, openSUSE-SU-2019:1664-1, RHSA-2019:1265-01, RHSA-2019:1267-01, RHSA-2019:1269-01, RHSA-2019:1308-01, RHSA-2019:1309-01, RHSA-2019:1310-01, SUSE-SU-2019:14114-1, SUSE-SU-2019:1458-1, USN-3896-1, USN-3997-1, VIGILANCE-VUL-28503.

Description of the vulnerability

An attacker can bypass access restrictions to data via ImageBitmapRenderingContext of Firefox, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2019-7317

libpng: use after free via png_image_free

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via png_image_free() of libpng, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, libpng, Firefox, Thunderbird, Java OpenJDK, openSUSE Leap, Java Oracle, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 05/02/2019.
Identifiers: 275, bulletinapr2019, cpujul2019, CVE-2019-7317, DSA-4435-1, MFSA-2019-14, MFSA-2019-15, openSUSE-SU-2019:1484-1, openSUSE-SU-2019:1530-1, openSUSE-SU-2019:1534-1, openSUSE-SU-2019:1664-1, RHSA-2019:1308-01, RHSA-2019:1309-01, RHSA-2019:1310-01, SSA:2019-107-01, SUSE-SU-2019:1388-1, SUSE-SU-2019:1398-1, SUSE-SU-2019:1398-2, SUSE-SU-2019:1405-1, SUSE-SU-2019:1458-1, USN-3962-1, VIGILANCE-VUL-28437.

Description of the vulnerability

An attacker can force the usage of a freed memory area via png_image_free() of libpng, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2018-12385

Firefox, Thunderbird: denial of service via TransportSecurityInfo

Synthesis of the vulnerability

An attacker can generate a fatal error via TransportSecurityInfo of Firefox/Thunderbird, in order to trigger a denial of service.
Impacted products: Debian, Fedora, Firefox, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: denial of service on client.
Provenance: document.
Creation date: 24/09/2018.
Identifiers: bulletinjan2019, CERTFR-2018-AVI-451, CERTFR-2018-AVI-469, CVE-2018-12385, DLA-1575-1, DSA-4304-1, DSA-4327-1, FEDORA-2018-3eed69eedc, FEDORA-2018-5f88837c1b, FEDORA-2018-a78cf5fcfc, FEDORA-2018-d64cb04921, MFSA-2018-23, MFSA-2018-25, openSUSE-SU-2018:2817-1, openSUSE-SU-2018:3051-1, openSUSE-SU-2018:3687-1, RHSA-2018:2834-01, RHSA-2018:2835-01, RHSA-2018:3403-01, RHSA-2018:3458-01, SSA:2018-265-01, SUSE-SU-2018:3247-1, SUSE-SU-2018:3476-1, SUSE-SU-2018:3591-1, SUSE-SU-2018:3591-2, USN-3778-1, USN-3793-1, VIGILANCE-VUL-27294.

Description of the vulnerability

An attacker can generate a fatal error via TransportSecurityInfo of Firefox/Thunderbird, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-5150 CVE-2018-5154 CVE-2018-5155

Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Thunderbird.
Impacted products: Debian, Fedora, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 13.
Creation date: 22/05/2018.
Identifiers: bulletinapr2018, CERTFR-2018-AVI-245, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5159, CVE-2018-5161, CVE-2018-5162, CVE-2018-5168, CVE-2018-5170, CVE-2018-5174, CVE-2018-5178, CVE-2018-5183, CVE-2018-5184, CVE-2018-5185, DLA-1382-1, DSA-4209-1, FEDORA-2018-ca9df6aaf1, MFSA-2018-13, openSUSE-SU-2018:1359-1, openSUSE-SU-2018:1361-1, RHSA-2018:1725-01, RHSA-2018:1726-01, SSA:2018-142-02, SUSE-SU-2018:2298-1, USN-3660-1, VIGILANCE-VUL-26170.

Description of the vulnerability

An attacker can use several vulnerabilities of Thunderbird.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2017-17688 CVE-2017-17689

Outlook Gpg4win, Thunderbird Enigmail: PGP and S/MIME decryption

Synthesis of the vulnerability

An attacker can use Outlook Gpg4win or Thunderbird Enigmail, in order to obtain sensitive information.
Impacted products: Debian, Fedora, Notes, Office, Outlook, Thunderbird, openSUSE Leap, Slackware, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: data reading.
Provenance: document.
Number of vulnerabilities in this bulletin: 2.
Creation date: 14/05/2018.
Revision date: 14/05/2018.
Identifiers: CERTFR-2018-ALE-007, CVE-2017-17688, CVE-2017-17689, DSA-4244-1, FEDORA-2018-1f651350de, FEDORA-2018-25525a9346, FEDORA-2018-6020628437, FEDORA-2018-73e30969a4, FEDORA-2018-77fe2e20ad, FEDORA-2018-e6ee09fc50, openSUSE-SU-2018:1329-1, openSUSE-SU-2018:1330-1, openSUSE-SU-2018:1347-1, openSUSE-SU-2018:1392-1, openSUSE-SU-2018:1393-1, openSUSE-SU-2018:1451-1, openSUSE-SU-2018:1454-1, SSA:2018-191-01, VIGILANCE-VUL-26123, VU#122919.

Description of the vulnerability

Plugins can be installed to automatically decrypt received emails encrypted with PGP or S/MIME:
 - Apple Mail : GPGTools
 - IBM Notes : PGP Lotus Notes Plug-In
 - Outlook : Gpg4win
 - Thunderbird : Enigmail
 - etc.

However, an attacker who has an encrypted email can use these plugins in order to decrypt it, for example using an image in an HTML email.

An attacker can therefore use Outlook Gpg4win or Thunderbird Enigmail, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2017-7829 CVE-2017-7846 CVE-2017-7847

Thunderbird: four vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Thunderbird.
Impacted products: Debian, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, data reading, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 4.
Creation date: 28/12/2017.
Identifiers: bulletinjan2018, CERTFR-2017-AVI-484, CVE-2017-7829, CVE-2017-7846, CVE-2017-7847, CVE-2017-7848, DLA-1223-1, DSA-4075-1, MFSA-2017-30, openSUSE-SU-2017:3433-1, openSUSE-SU-2017:3434-1, RHSA-2018:0061-01, SSA:2017-356-01, USN-3529-1, VIGILANCE-VUL-24877.

Description of the vulnerability

An attacker can use several vulnerabilities of Thunderbird.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2017-7845

Firefox, Thunderbird: buffer overflow via ANGLE Library Using Direct 3D 9

Synthesis of the vulnerability

An attacker can generate a buffer overflow via ANGLE Library Using Direct 3D 9 of Firefox/Thunderbird, in order to trigger a denial of service, and possibly to run code.
Impacted products: Fedora, Firefox, Thunderbird.
Severity: 4/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 08/12/2017.
Identifiers: CERTFR-2017-AVI-455, CVE-2017-7845, FEDORA-2018-16a76da6cc, FEDORA-2018-3ec87df5ba, FEDORA-2018-4e65ec8cc4, FEDORA-2018-e1539d9bc6, MFSA-2017-28, MFSA-2017-29, MFSA-2017-30, VIGILANCE-VUL-24705.

Description of the vulnerability

An attacker can generate a buffer overflow via ANGLE Library Using Direct 3D 9 of Firefox/Thunderbird, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note 24664

Mail client: sender spoofing via Mailsploit

Synthesis of the vulnerability

An attacker can send an email with a special From header, which is truncated by some mail clients, in order to deceive the victim.
Impacted products: iOS by Apple, iPhone, Mac OS X, Notes, Office, Outlook, SeaMonkey, Thunderbird, Synology DSM.
Severity: 3/4.
Consequences: disguisement.
Provenance: document.
Creation date: 06/12/2017.
Identifiers: CERTFR-2017-ALE-019, Mailsploit, MFSA-2017-30, Synology-SA-17:82, VIGILANCE-VUL-24664.

Description of the vulnerability

Messaging clients interpret the From header to display the sender name.

However, using a Base64 or Quoted Printable encoding, and '\0' or '\n' characters, an attacker can force the displayed email address to be truncated.

An attacker can therefore send an email with a special From header, which is truncated by some mail clients, in order to deceive the victim.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2017-7826 CVE-2017-7827 CVE-2017-7828

Mozilla Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox/Thunderbird.
Impacted products: Debian, Fedora, Firefox, Thunderbird, openSUSE Leap, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 15.
Creation date: 14/11/2017.
Identifiers: CERTFR-2017-AVI-412, CERTFR-2017-AVI-431, CVE-2017-7826, CVE-2017-7827, CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833, CVE-2017-7834, CVE-2017-7835, CVE-2017-7836, CVE-2017-7837, CVE-2017-7838, CVE-2017-7839, CVE-2017-7840, CVE-2017-7842, DLA-1172-1, DLA-1199-1, DSA-4035-1, DSA-4061-1, DSA-4075-1, FEDORA-2017-463cb2af78, FEDORA-2017-7d33609b3d, FEDORA-2017-9a6569beb6, FEDORA-2017-b410301903, FEDORA-2017-e1e3fbcd3c, MFSA-2017-24, MFSA-2017-25, MFSA-2017-26, openSUSE-SU-2017:3027-1, openSUSE-SU-2017:3108-1, openSUSE-SU-2017:3110-1, RHSA-2017:3247-01, RHSA-2017:3372-01, SSA:2017-320-02, SUSE-SU-2017:3213-1, SUSE-SU-2017:3233-1, USN-3477-1, USN-3477-2, USN-3477-3, USN-3477-4, USN-3490-1, USN-3688-1, VIGILANCE-VUL-24431.

Description of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox/Thunderbird.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2017-7793 CVE-2017-7810 CVE-2017-7811

Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 17.
Creation date: 29/09/2017.
Identifiers: bulletinoct2017, CERTFR-2017-AVI-327, CERTFR-2017-AVI-340, CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7816, CVE-2017-7817, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7821, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824, CVE-2017-7825, DLA-1118-1, DLA-1153-1, DSA-3987-1, DSA-4014-1, FEDORA-2017-2e7badfe67, FEDORA-2017-6967efb3f0, FEDORA-2017-6e2071419d, FEDORA-2017-730e299c49, FEDORA-2017-845c543ea4, MFSA-2017-21, MFSA-2017-22, MFSA-2017-23, openSUSE-SU-2017:2615-1, openSUSE-SU-2017:2707-1, openSUSE-SU-2017:2710-1, RHSA-2017:2831-01, RHSA-2017:2885-01, SSA:2017-271-01, SUSE-SU-2017:2688-1, SUSE-SU-2017:2872-1, SUSE-SU-2017:2872-2, USN-3435-1, USN-3435-2, USN-3436-1, USN-3688-1, VIGILANCE-VUL-23970.

Description of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Mozilla Thunderbird: