USN-3997-1: Thunderbird vulnerabilities

28 May 2019

Several security issues were fixed in Thunderbird.

Releases

Packages

  • thunderbird - Mozilla Open Source mail and newsgroup client

Details

Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same-origin protections, or execute arbitrary code.
(CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,
CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)

Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service, or execute
arbitrary code. (CVE-2019-5798, CVE-2019-7317)

A type confusion bug was discovered with object groups and UnboxedObjects.
If a user were tricked in to opening a specially crafted website in a
browsing context after enabling the UnboxedObjects feature, an attacker
could potentially exploit this to bypass security checks. (CVE-2019-9816)

It was discovered that history data could be exposed via drag and drop
of hyperlinks to and from bookmarks. If a user were tricked in to dragging
a specially crafted hyperlink to a bookmark toolbar or sidebar, and
subsequently back in to the web content area, an attacker could
potentially exploit this to obtain sensitive information. (CVE-2019-11698)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
Ubuntu 18.10
Ubuntu 18.04
Ubuntu 16.04

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

Related notices

  • USN-3896-1: firefox
  • USN-3918-1: firefox
  • USN-3918-2: firefox
  • USN-3962-1: libpng1.6, libpng16-16
  • USN-3991-1: firefox
  • USN-4080-1: openjdk-8-jdk-headless, openjdk-8-jre-jamvm, openjdk-8-jre-zero, openjdk-8-jre-headless, openjdk-8, openjdk-8-jre, openjdk-8-jdk
  • USN-4083-1: openjdk-11-jre, openjdk-11-jdk, openjdk-11-jre-zero, openjdk-11-jre-headless, openjdk-11-jdk-headless, openjdk-lts