Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1594
Multiple security issues have been found in Thunderbird
28 May 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: thunderbird
Publisher: Debian
Operating System: Debian GNU/Linux 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Unauthorised Access -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-5185 CVE-2018-5184 CVE-2018-5183
CVE-2018-5178 CVE-2018-5170 CVE-2018-5168
CVE-2018-5162 CVE-2018-5161 CVE-2018-5159
CVE-2018-5155 CVE-2018-5154 CVE-2018-5150
Reference: ASB-2018.0119
ASB-2018.0110
ASB-2018.0109
ESB-2018.1586
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : thunderbird
Version : 1:52.8.0-1~deb7u1
CVE ID : CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5159
CVE-2018-5161 CVE-2018-5162 CVE-2018-5168 CVE-2018-5170
CVE-2018-5178 CVE-2018-5183 CVE-2018-5184 CVE-2018-5185
Multiple security issues have been found in Thunderbird, which may lead
to the execution of arbitrary code, denial of service or attacks on
encrypted emails.
For Debian 7 "Wheezy", these problems have been fixed in version
1:52.8.0-1~deb7u1.
We recommend that you upgrade your thunderbird packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAlsHy44ACgkQnUbEiOQ2
gwKw7A//aHjd5Kz/Ru9yRZNLuTI3Gqw7umJLTu8ajPv2vcAdBj2RMpg9GpS9yycW
n4hucgCXDTPXQGG+y2gczvxqSZCroCGJTxqrept1NAQBnCQUe3X86bGrPlmM3jl2
3+S2UUj32A5ioaV15gjx9BDZdLi4caY3TVFpglOEXWZPJfJ12pK1yf9SQMsIIMNO
S9M18mNfgdxIrEB/xSu8rFrot/IyQZG0aWUqboFQOK1DFFeVS6o+VeDFAar5BuPY
2jfGTIQSsQdw+8RHSdECnONHF82cGr8DYlSoQIhN6S9F5Y1YiF6/zapwDCI6qf1G
Kzz+QNEyvsfs0P0qVzAq/+0zUV5m4Sfut5ha5LbUrHjXgqTgrHpBH0dfEJL8qso0
Xfj9NKhvrovUXmX1t7/PYhvVM7YRPvqcsUsHZhPf39PfVDe+jvQ+IjYwtzvxC0so
yGFeOiScSSTszHy60d9z+GMNwFeM8YbLBwgCektiGoHMgmJbJ4Mxkph13lWU8v9+
bydJKjIen0ib0YLb1gw7OATQE82x3ZGIyaXSDUAqBaQqLlBMUupumtpNsjsFBRzd
8SAj3blSvvYkNYsVRoh5H927bJFshDBAP6AsocP/BTo8CStbLBDWQ1OJIUcRpysY
oOdJBTkQ2Awj4ry0bZN0IXVqJPUlEqhwjJyjcI/+0b7s5b1zbCM=
=ELPS
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWwtHlWaOgq3Tt24GAQgwXBAAgB40+oe5N/28I9/WvHT2bAlFcnaVbJC7
4snaM5ST7DPGn0yUpzH4LULfqU93HSVSsPm+b+chs2kWBLqr7knrC3KBzHD2AjtB
SVsr1IVk4fFTX0EF7xeYGwLkROl2UZVhpPhe8iFOU5uOCTpu9Dh31qaf16tRxxTP
4nGlW/Bls6NW15YglnI81lVeFP6xn6rcpCvFzfose45CTmPR5WAtOt6Jw67Cv+qy
+HRtzZg62wClmEGLZh2UR/ukaUqgV91+8K0CjvIzlORzb8B7uSH1YwHd1ixH4cVr
xd/VXBbkBxToMHCgHaYLJhTN/vFGBWY5AvNvVdIfY/5K3KzBuIigw9gJGQe/YCON
hH7+qy0zRtzggPjuqaShud7i1h08Tuyoc3ABDg0vNGWMBLae32mQGrBOmUhCMfun
+eQDdRWTtXAkhSGdBYTcXK7XO6mPKwrotKKx81vJEcL0h/AybmGedNpeSV1ha1TP
/FqNNQFB2hFyjjz0E3jgO7rTjr1vg1JazDqVPKww4NgX7gojbdk/k4vUQSTw41V8
4jT+cRrOXW+O3A/iaoQGqj6TMFiOo5p0FiHk5ZuxOt1v9nmoHcrUwiC9UO0rpwIR
UxmsiGSF3ERUiPQqc6I2idzoUDShAz0emwD7uah/7lpuaBy4VGZUEMYbACt6xvup
6A9Vwaaqzsg=
=Eece
-----END PGP SIGNATURE-----