[ALAS2-2020-1429] Amazon Linux 2 2017.12 - ALAS2-2020-1429: critical priority package update for thunderbird

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2020-6831:
A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
1831763: CVE-2020-6831 usrsctp: Buffer overflow in AUTH chunk input validation

CVE-2020-6825:
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
1821682: CVE-2020-6825 Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7

CVE-2020-6822:
On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
1821676: CVE-2020-6822 Mozilla: Out of bounds write in GMPDecodeData when processing large images

CVE-2020-6821:
When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
1821674: CVE-2020-6821 Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

CVE-2020-6820:
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
1820878: CVE-2020-6820 Mozilla: Use-after-free when handling a ReadableStream

CVE-2020-6819:
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
1820869: CVE-2020-6819 Mozilla: Use-after-free while running the nsDocShell destructor

CVE-2020-12397:
No description is available for this CVE.
1832565: CVE-2020-12397 Mozilla: Sender Email Address Spoofing using encoded Unicode characters

CVE-2020-12395:
Memory safety flaws were found in Mozilla Firefox and Thunderbird. Memory corruption that an attacker could leverage with enough effort, could allow arbitrary code to run. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
1831765: CVE-2020-12395 Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

CVE-2020-12392:
The Mozilla Foundation Security Advisory describes this flaw as:
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files.
1831764: CVE-2020-12392 Mozilla: Arbitrary local file access with 'Copy as cURL'

CVE-2020-12387:
A flaw was found in Mozilla Firefox and Thunderbird. When running shutdown code for Web Worker, a race condition occurs leading to a use-after-free memory flaw that could lead to an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
1831761: CVE-2020-12387 Mozilla: Use-after-free during worker shutdown