ESB-2018.2051 - [Debian] thunderbird: Multiple vulnerabilities 2018-07-16

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2051
                        thunderbird security update
                               16 July 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           thunderbird
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Cross-site Request Forgery      -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Access Confidential Data        -- Remote/Unauthenticated      
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-12374 CVE-2018-12373 CVE-2018-12372
                   CVE-2018-12366 CVE-2018-12365 CVE-2018-12364
                   CVE-2018-12363 CVE-2018-12362 CVE-2018-12360
                   CVE-2018-12359 CVE-2018-5188 CVE-2017-17689

Reference:         ASB-2018.0146
                   ASB-2018.0140
                   ESB-2018.2040
                   ESB-2018.1894

Original Bulletin: 
   https://www.debian.org/security/2018/dsa-4244

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4244-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
July 13, 2018                         https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : thunderbird
CVE ID         : CVE-2017-17689 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 
                 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 
                 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374

Multiple security issues have been found in Thunderbird, which may lead
to the execution of arbitrary code, denial of service or attacks on
encrypted emails.

For the stable distribution (stretch), these problems have been fixed in
version 1:52.9.1-1~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltI+2sACgkQEMKTtsN8
TjZXHRAAgOmSvTwwmmzxRH/4tSSpndZCFCtkHrG5PU5D3XesLGnWpNZk9aINsaU2
ih3fmEKzQgHHfAzK3d9TcGjyiI+PoVuWkVknsVqTrHd+xQtxUs7B/5Pfz5WKiYDJ
QJ4NhjTgHHystYa0j2CvK28/ZoPVZgwnc/D051ChTInPWXimJI+TxpsndW/NPuaJ
SphoPP34OMO2EARjrKCxiL6NRv6kD4CJv0AgoYfdO0qPXomuA8HpDAH1itd7GbRq
yVJoZRnpz9dGjJSM5wyFCc1BIqmA/CMphhmqiRTuFBA+rOSEDblzfc2tg9t82CVQ
caA7rF3VrYx8qmgpP3akCju+SDOEWLerFGHH1iaQ+GBqiXvduvMl/MSXCZmVZzIC
92Ko2m9kURkak4yKccEbHJ5Vh8i0oLUOc+Ee3MUUfWUblYbCcB4z34p9hRwc8u83
mmGUbsq+qWvdcd9NkekKC/ENQZt4Egb3doeEzqSkaa4uhFaQ1gGosHXGslNTCqLl
6RyeFON9Q5CWphQET+rmnlcJ8B1cSHgpG1ZTN6szlsQpiVgcRu/JYrgyzX9Y6WdY
rAape6t+gsEeLOP7n9pZ/KYSadUF5CvYY/nX9H6kJO1RmG9y0A+8wAEuW+nSOMMJ
vh2U09+y5XJHQqV0MMTKbnadxlyi8Oerc0zrYaoBuYhR7wmvkus=
=R2OH
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW0vsCGaOgq3Tt24GAQgLeQ/9HMqppsqRHdG99nIiUGGXOXLsCHljYr7m
K6+B8vx9ENSOqxAdu7AW3Q8mBZMphCfTYx3g+yQF61IDUvg9pD3yvoEFH05ROkzI
a002IwcgJp5sjkRo+cKVE2X/uyUo9KCFxfArF9KkjvwOVIyeJHI7SUBn19DSH2JX
YfHvQqzI3odESmFurNdeHnMXwFf/w9KTq86Zs8gtvUqDr5dppvPe6j9Ts3k2siuM
SOOho9Q8XqrL8T8ZlYaoHQLOS7Epam+c2Frt59eINFc6kywRhIPgUwzcEPiMOqA+
WRyJPFlDjlASWsPsULxpnDyIGNLe/AxUx7tp7r1Nq2c5AEzQvDH+db0HtnFYpwPC
4W8gcn6frEdVCYHydnBbnxM4q5sAnWKUqw7aBpfeq3y/vq3idi0MIFpWNrKtaGRy
6Kl84IRyW0DBNhrgkxHpwQo/ZVILYA7KsVqv4pilF+QY02YcU3kFUNIhvtDbCZ+L
XyxT8mNZlqO7YhMwPsneO8P6d3VFs1tlzto1fF1naXd7t7TUVxYXm3Bdv+JkrmO3
9YBKZDTL6GpdhifPHonoY8wGIpM+ZqnfjEL3bFkNLlRXY8F53HWfNbXDxh/i0w7T
DjJ2Ia5ecPvzgeX3agOpW06y0zxlKKOOnFuWFkTwykHsH9lL2PtkRYhOhy49XOEz
knnVqXwytVM=
=PoN4
-----END PGP SIGNATURE-----

« Back to bulletins