USN-4328-1: Thunderbird vulnerabilities
13 April 2020
Several security issues were fixed in Thunderbird.
Releases
Packages
- thunderbird - Mozilla Open Source mail and newsgroup client
Details
It was discovered that Message ID calculation was based on uninitialized
data. An attacker could potentially exploit this to obtain sensitive
information. (CVE-2020-6792)
Mutiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795,
CVE-2020-6822)
It was discovered that if a user saved passwords before Thunderbird 60
and then later set a master password, an unencrypted copy of these
passwords would still be accessible. A local user could exploit this to
obtain sensitive information. (CVE-2020-6794)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
conduct cross-site scripting (XSS) attacks, obtain sensitive information,
or execute arbitrary code. (CVE-2019-20503, CVE-2020-6798, CVE-2020-6800,
CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814,
CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)
It was discovered that the Devtools’ ‘Copy as cURL’ feature did not
fully escape website-controlled data. If a user were tricked in to using
the ‘Copy as cURL’ feature to copy and paste a command with specially
crafted data in to a terminal, an attacker could potentially exploit this
to execute arbitrary commands via command injection. (CVE-2020-6811)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.10
Ubuntu 18.04
After a standard system update you need to restart Thunderbird to make
all the necessary changes.