Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0182
thunderbird security update
17 January 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: thunderbird
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-17026 CVE-2019-17024 CVE-2019-17022
CVE-2019-17017 CVE-2019-17016
Reference: ESB-2020.0180
ESB-2020.0152
ESB-2020.0128
ESB-2020.0078
ESB-2020.0055
ESB-2020.0054
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:0123
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: thunderbird security update
Advisory ID: RHSA-2020:0123-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0123
Issue date: 2020-01-16
CVE Names: CVE-2019-17016 CVE-2019-17017 CVE-2019-17022
CVE-2019-17024 CVE-2019-17026
=====================================================================
1. Summary:
An update for thunderbird is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
3. Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 68.4.1.
Security Fix(es):
* Mozilla: IonMonkey type confusion with StoreElementHole and
FallibleStoreElement (CVE-2019-17026)
* Mozilla: Bypass of @namespace CSS sanitization during pasting
(CVE-2019-17016)
* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)
* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
(CVE-2019-17024)
* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of Thunderbird must be restarted for the update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1788723 - CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
1788724 - CVE-2019-17017 Mozilla: Type Confusion in XPCVariant.cpp
1788726 - CVE-2019-17022 Mozilla: CSS sanitization does not escape HTML tags
1788727 - CVE-2019-17024 Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
1789214 - CVE-2019-17026 Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
thunderbird-68.4.1-2.el6_10.src.rpm
i386:
thunderbird-68.4.1-2.el6_10.i686.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.i686.rpm
x86_64:
thunderbird-68.4.1-2.el6_10.x86_64.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
thunderbird-68.4.1-2.el6_10.src.rpm
i386:
thunderbird-68.4.1-2.el6_10.i686.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.i686.rpm
ppc64:
thunderbird-68.4.1-2.el6_10.ppc64.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.ppc64.rpm
s390x:
thunderbird-68.4.1-2.el6_10.s390x.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.s390x.rpm
x86_64:
thunderbird-68.4.1-2.el6_10.x86_64.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
thunderbird-68.4.1-2.el6_10.src.rpm
i386:
thunderbird-68.4.1-2.el6_10.i686.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.i686.rpm
x86_64:
thunderbird-68.4.1-2.el6_10.x86_64.rpm
thunderbird-debuginfo-68.4.1-2.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17016
https://access.redhat.com/security/cve/CVE-2019-17017
https://access.redhat.com/security/cve/CVE-2019-17022
https://access.redhat.com/security/cve/CVE-2019-17024
https://access.redhat.com/security/cve/CVE-2019-17026
https://access.redhat.com/security/updates/classification/#important
https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXiBOKtzjgjWX9erEAQjj5RAAhVnms2w25et8xgW+BQTN8GDQaVr20tE0
cR8bgrmOEI10PKLPS9lWkZYTUyydm8Z38ZseDCvv4yh2lqYWt4P1sGDbAtMZ477w
Oi7BTTCPL2jaZgAJypRNdXPRlZIPDFhr598MVzhzP8ns20+NFGd1rDK9UziSKwdI
Cq8N788vREyD2RL+zAVHtchgxR5mqCe1dkadLIudu+GXt4jPJRtIDSP8wkSzaNTQ
tOJdr4LBpVWXgQ2YvljW1IjzSOaVbUxl26L9X4SYpfrryBXfSo53OdNH+jefQRBG
A240UvtlM5RZpPOjTJwM8IL+EG9/m7YPbXrd9cU8AQSyiCuhffO6i5mYqEVz8Zva
TLKdCMF81hfYRX4Kkiis7blvUEuLGqfagMO6GdP+ZIWIRPp1+awUhmjcodxPESb3
H393Yo8b5y/2hPjaHRmQ2kYUIXAJ22H2/4HFdw7XC5EzV1mZiPaoA+C3k2Td2gmk
lZtkeGA3fH0oPLgxP4XXFP++5SIYUyoZ2nD23l/8U9feFu3+561gFAwNWxXrF7Xi
kHGBtRDL/93qCTZq4bdZ1zvhkmFRF926v5UcTN9RTmPkKCPJ4z9qJ5PxAsq60rRt
I0B3OSotY8za6yfuG3bnpoF6hQ1569nphv9ebZOQ3opwxp8gp1yGMrJQWOdSX/gH
3sVmrqcRM/o=
=mj+0
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXiEnsmaOgq3Tt24GAQjlKhAAzPm8ijIjd3wAUvebTmvWdTWaeYSjaYI4
ALmKKC6hRUFcpJKykrPAUVvXQdqN5PogsYQh/v7zi1RithejCCJtKRB4udKOuXN7
hw5/fP6gZ9wAMTmsCAOLKlPaQ1nqDigZz+9nkuEiSV8WgxMEzUCU70Sxyef76XB6
btFUkx2G/NF+TLXATaCNPdrBUeB+6qUOKgmE2Fu2NiS2IPszCTv9aweIkk19Xk2o
6NLOnP78pVorQz2we5Qpo+irpg++GVCF1zP601Li+3yyCqNBVOjm8V+hrm270eVw
R8MXefQvET3yrR2wirY3EFnFIRjdX+Y8++UMur5W0cO4/CmJSkcI460E+tVWYNiy
5VDg7oZc+fbIkfDuHO++SwAP1IUfPYz3t+wDjth13XDVFCzJycNBvQcyCGhs5oKc
xIoiJrHKRuCzENMuC7ihCOCycKQUdw9F9tXZeQMPqjREZHpxpZFCVdUL2iAaU8Yf
op9dg3Cw4suRIE25MV9c/ujOsWwI30G0UWxTUvv+tCUAazuBajzM+8btsTzLHuP4
30sA8O4CqzL3ct0+n+l5YhKFHx192hpfY9gpJOvAZ78RO2ZwTQPGOfi0lyg8JBat
uwyuHNPoc5Z22gyObeElwLWC6wOUfhBpJhUnz3mYBejLJGXk8flqE1CKIavH7HXh
p5UGsdMUSos=
=uXev
-----END PGP SIGNATURE-----