ESB-2018.1966 - [SUSE] Mozilla Thunderbird: Multiple vulnerabilities 2018-07-09

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.1966
                  Thunderbird 52.9.0 comes to SUSE Linux
                                9 July 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Mozilla Thunderbird
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Cross-site Request Forgery      -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Read-only Data Access           -- Remote with User Interaction
                   Access Confidential Data        -- Remote with User Interaction
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-12374 CVE-2018-12373 CVE-2018-12372
                   CVE-2018-12366 CVE-2018-12365 CVE-2018-12364
                   CVE-2018-12363 CVE-2018-12362 CVE-2018-12360
                   CVE-2018-12359 CVE-2018-5188 

Reference:         ASB-2018.0146
                   ASB-2018.0140
                   ASB-2018.0139
                   ESB-2018.1904

Original Bulletin: 
   https://lists.opensuse.org/opensuse-security-announce/2018-07/msg00008.html

- --------------------------BEGIN INCLUDED TEXT--------------------

   openSUSE Security Update: Security update for Mozilla Thunderbird
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1907-1
Rating:             moderate
References:         #1076907 #1085780 #1091376 #1098998 #1100079 
                    #1100081 #1100082 
Cross-References:   CVE-2018-12359 CVE-2018-12360 CVE-2018-12362
                    CVE-2018-12363 CVE-2018-12364 CVE-2018-12365
                    CVE-2018-12366 CVE-2018-12372 CVE-2018-12373
                    CVE-2018-12374 CVE-2018-5188
Affected Products:
                    SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

   An update that fixes 11 vulnerabilities is now available.

Description:

   This update for Mozilla Thunderbird to version 52.9.0 fixes multiple
   issues.

   Security issues fixed, inherited from the Mozilla common code base (MFSA
   2018-16, bsc#1098998):

   - CVE-2018-12359: Buffer overflow using computed size of canvas element
   - CVE-2018-12360: Use-after-free when using focus()
   - CVE-2018-12362: Integer overflow in SSSE3 scaler
   - CVE-2018-12363: Use-after-free when appending DOM nodes
   - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
   - CVE-2018-12365: Compromised IPC child process can list local filenames
   - CVE-2018-12366: Invalid data handling during QCMS transformations
   - CVE-2018-5188: Memory safety bugs fixed in Thunderbird 52.9.0

   Security issues fixed that affect e-mail privacy and integrity (including
   EFAIL):

   - CVE-2018-12372: S/MIME and PGP decryption oracles can be built with HTML
     emails (bsc#1100082)
   - CVE-2018-12373: S/MIME plaintext can be leaked through HTML
     reply/forward (bsc#1100079)
   - CVE-2018-12374: Using form to exfiltrate encrypted mail part by pressing
     enter in form field (bsc#1100081)

   The following options are available for added security in certain
   scenarios:

   - Option for not decrypting subordinate message parts that otherwise might
     reveal decryted content to the attacker. Preference
     mailnews.p7m_subparts_external needs to be set to true for added
     security.

   The following upstream changes are included:

   - Thunderbird will now prompt to compact IMAP folders even if the account
     is online
   - Fix various problems when forwarding messages inline when using "simple"
     HTML view

   The following tracked packaging changes are included:

   - correct requires and provides handling (boo#1076907)
   - reduce memory footprint with %ix86 at linking time via additional
     compiler flags (boo#1091376)
   - Build from upstream source archive and verify source signature
     (boo#1085780)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Package Hub for SUSE Linux Enterprise 12:

      zypper in -t patch openSUSE-2018-701=1



Package List:

   - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):

      MozillaThunderbird-52.9.0-65.1
      MozillaThunderbird-buildsymbols-52.9.0-65.1
      MozillaThunderbird-debuginfo-52.9.0-65.1
      MozillaThunderbird-debugsource-52.9.0-65.1
      MozillaThunderbird-devel-52.9.0-65.1
      MozillaThunderbird-translations-common-52.9.0-65.1
      MozillaThunderbird-translations-other-52.9.0-65.1


References:

   https://www.suse.com/security/cve/CVE-2018-12359.html
   https://www.suse.com/security/cve/CVE-2018-12360.html
   https://www.suse.com/security/cve/CVE-2018-12362.html
   https://www.suse.com/security/cve/CVE-2018-12363.html
   https://www.suse.com/security/cve/CVE-2018-12364.html
   https://www.suse.com/security/cve/CVE-2018-12365.html
   https://www.suse.com/security/cve/CVE-2018-12366.html
   https://www.suse.com/security/cve/CVE-2018-12372.html
   https://www.suse.com/security/cve/CVE-2018-12373.html
   https://www.suse.com/security/cve/CVE-2018-12374.html
   https://www.suse.com/security/cve/CVE-2018-5188.html
   https://bugzilla.suse.com/1076907
   https://bugzilla.suse.com/1085780
   https://bugzilla.suse.com/1091376
   https://bugzilla.suse.com/1098998
   https://bugzilla.suse.com/1100079
   https://bugzilla.suse.com/1100081
   https://bugzilla.suse.com/1100082

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW0KlSGaOgq3Tt24GAQiJFxAAt/uLErDTVALee5poXp8qnc6E0Y9+VCYL
isle0Y7dzaj2rZI4+l2brMfAWBA9NKaHP3iXYtNyhrlJs0ei3I6gFl8LrFDuAcXC
Smhc5TRCn1b6+JDC/3bk2lrJORnKewYYz0SwC8GeLW2Bsj2lB4zm8vhh3WjXlkG9
OvItUPdSOhQumZHYj0465aYPOETdrYH0uCE2fhL8caCSxbN0M7Q61NsRpuvnpNga
i8rzxNCHsuCYxBnA6PsRpKgdAPjmkiSkRyVHxfsE+BVc3givFi3QvxPqHvanR4vQ
pSwDa++j3Zp/zYKKgCSVtuCbGheaywaHuz0DCqhfAN4k76/w+qgrMvEw33yZ1vIA
Bh6hiWwSGox4IOI8eNpBhNqs5ojvvDuqDPbfyC7FbPbFAoYGIPwrCHbk7+qzMIE4
xWnOnrVOT6oVT0mj06z+Y/5rwSKvGQvxJehckKM29GbWuHMnbHrQCyzwxbetG3md
JKrYxE/2PC/1ruqlEYrlkEosUFtntpfjcl5Fb+aoI3l+momc6jDc3iuj18ISYadS
oAJDhfYypczCfIk70/URlyLmuQszcEp9gV+MDzdge4nhb8uRik0qMQfAOIOlueo3
NLeyUmgoWI6n2Vf2irTQaWHnyA01FjLBKkjEjMggBy5B6chiZDyGvU/IZ/i26gT+
fdPOFUKdW4o=
=lT1b
-----END PGP SIGNATURE-----

« Back to bulletins