Security update for MozillaThunderbird SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1606-1 Final 1 1 2019-06-24T10:32:20Z current 2019-06-24T10:32:20Z 2019-06-24T10:32:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaThunderbird This update for MozillaThunderbird fixes the following issues: Security issues fixed: - CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595). - CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595). - CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595). - CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595). - CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872). - CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-1606 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF E-Mail link for openSUSE-SU-2019:1606-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1137595 SUSE Bug 1137595 https://bugzilla.suse.com/1138872 SUSE Bug 1138872 https://www.suse.com/security/cve/CVE-2019-11703/ SUSE CVE CVE-2019-11703 page https://www.suse.com/security/cve/CVE-2019-11704/ SUSE CVE CVE-2019-11704 page https://www.suse.com/security/cve/CVE-2019-11705/ SUSE CVE CVE-2019-11705 page https://www.suse.com/security/cve/CVE-2019-11706/ SUSE CVE CVE-2019-11706 page https://www.suse.com/security/cve/CVE-2019-11707/ SUSE CVE CVE-2019-11707 page https://www.suse.com/security/cve/CVE-2019-11708/ SUSE CVE CVE-2019-11708 page openSUSE Leap 15.0 openSUSE Leap 15.1 MozillaThunderbird-60.7.2-lp151.2.7.1 MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 MozillaThunderbird-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.0 MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.0 MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.0 MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.0 MozillaThunderbird-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.1 MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.1 MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.1 MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 as a component of openSUSE Leap 15.1 A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. CVE-2019-11703 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11703.html CVE-2019-11703 https://bugzilla.suse.com/1137595 SUSE Bug 1137595 A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. CVE-2019-11704 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11704.html CVE-2019-11704 https://bugzilla.suse.com/1137595 SUSE Bug 1137595 A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. CVE-2019-11705 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11705.html CVE-2019-11705 https://bugzilla.suse.com/1137595 SUSE Bug 1137595 A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1. CVE-2019-11706 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 critical 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11706.html CVE-2019-11706 https://bugzilla.suse.com/1137595 SUSE Bug 1137595 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. CVE-2019-11707 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11707.html CVE-2019-11707 https://bugzilla.suse.com/1138614 SUSE Bug 1138614 Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. CVE-2019-11708 openSUSE Leap 15.0:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.0:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-buildsymbols-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-common-60.7.2-lp151.2.7.1 openSUSE Leap 15.1:MozillaThunderbird-translations-other-60.7.2-lp151.2.7.1 critical 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF/#LLKQ5EZXADDPRD2AIRRG5BLXWO4VGDSF https://www.suse.com/security/cve/CVE-2019-11708.html CVE-2019-11708 https://bugzilla.suse.com/1138872 SUSE Bug 1138872