This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

  - Mozilla: Use-after-free in worker destruction     (CVE-2019-17008)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and     Firefox ESR 68.3 (CVE-2019-17012)

  - Mozilla: Buffer overflow in plain text serializer     (CVE-2019-17005)

  - Mozilla: Use-after-free when performing device     orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in     antitracking (CVE-2019-17011)

New mozilla-firefox packages are available for Slackware 14.2 and
-current to fix security issues.

The version of Firefox installed on the remote Windows host is prior to 71.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-36 advisory.

  - Mozilla developers and community members Philipp, Diego Calleja, Mikhail Gavrilov, Jason Kratzer,     Christian Holler, Markus Stange, Tyson Smith reported memory safety bugs present in Firefox 70. Some of     these bugs showed evidence of memory corruption and we presume that with enough effort some of these could     have been exploited to run arbitrary code. (CVE-2019-17013)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). (CVE-2019-11756)

  - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a     potentially exploitable crash. (CVE-2019-17008)

  - When setting a thread name on Windows in WebRTC, an incorrect number of arguments could have been     supplied, leading to stack corruption and a potentially exploitable crash.  Note: this issue only occurs     on Windows. Other operating systems are unaffected. (CVE-2019-13722)

  - When encrypting with a block cipher, if a call to <code>NSCEncryptUpdate</code> was made with data smaller     than the block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-10 (Mozilla Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, cause a Denial       of Service condition, obtain sensitive information, or conduct Cross-Site       Request Forgery (CSRF).
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-202003-02 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to perform Man-in-the-Middle attacks,       obtain sensitive information, spoof the address bar, conduct clickjacking       attacks, bypass security restrictions and protection mechanisms, or have       other unspecified impact.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
131989	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20191210)	Nessus	Scientific Linux Local Security Checks	2019/12/12	2024/4/4	high
131681	Slackware 14.2 / current : mozilla-firefox (SSA:2019-337-01)	Nessus	Slackware Local Security Checks	2019/12/4	2024/4/5	high
131773	Mozilla Firefox < 71.0	Nessus	Windows	2019/12/6	2025/11/18	high
134587	GLSA-202003-10 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/16	2020/9/28	critical
134469	GLSA-202003-02 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/13	2022/12/7	critical
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical

偵測

搜尋 Plugin

high

high

high

critical

critical

critical