[MFSA-2017-09] Security vulnerabilities fixed in - Thunderbird 52

CVE-2017-5398: Memory safety bugs fixed in Thunderbird 52 and Thunderbird 45.8 (critical)
Mozilla developers and community members Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, André Bargull, Kan-Ru Chen, and Nathan Froyd reported memory safety bugs present in Firefox 51 and Firefox ESR 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.

CVE-2017-5399: Memory safety bugs fixed in Thunderbird 52 (critical)
Mozilla developers and community members Carsten Book, Calixte Denizet, Christian Holler, Andrew McCreight, David Bolter, David Keeler, Jon Coppeard, Tyson Smith, Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed Davis, Julian Seward, Julian Hector, Philipp, Markus Stange, and André Bargull reported memory safety bugs present in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.

CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP (critical)
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

CVE-2017-5401: Memory Corruption when handling ErrorResult (critical)
A crash triggerable by web content in which an <code>ErrorResult</code> references unassigned memory due to a logic error. The resulting crash may be exploitable.

CVE-2017-5402: Use-after-free working with events in FontFace objects (critical)
A use-after-free can occur when events are fired for a <code>FontFace</code> object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash.

CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object (critical)
When adding a range to an object in the DOM, it is possible to use <code>addRange</code> to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash.

CVE-2017-5404: Use-after-free working with ranges in selections (critical)
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash.

CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports (low)
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.

CVE-2017-5406: Segmentation fault in Skia with canvas operations (high)
A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.

CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters (high)
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure.

CVE-2017-5408: Cross-origin reading of video captions in violation of CORS (moderate)
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions.

CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping (high)
Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup.

CVE-2017-5411: Use-after-free in Buffer Storage in libGLES (high)
A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, leading to a potentially exploitable crash.
Note: This issue is in <code>libGLES</code>, which is only in use on Windows. Other operating systems are not affected.

CVE-2017-5412: Buffer overflow read in SVG filters (moderate)
A buffer overflow read during SVG filter color value operations, resulting in data exposure.

CVE-2017-5413: Segmentation fault during bidirectional operations (moderate)
A segmentation fault can occur during some bidirectional layout operations.

CVE-2017-5414: File picker can choose incorrect default directory (moderate)
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name.

CVE-2017-5416: Null dereference crash in HttpChannel (moderate)
In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice.

CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses (low)
An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns.

CVE-2017-5419: Repeated authentication prompts lead to DOS attack (low)
If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack.

CVE-2017-5421: Print preview spoofing (low)
A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded.

CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink (low)
If a malicious site uses the <code>view-source:</code> protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer making <code>view-source:</code> linkable.

CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access (moderate)
The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of <code>/private/var</code> that could expose personal or temporary data. This has been updated to not allow access to <code>/private/var</code> and its subdirectories.
Note: this issue only affects OS X. Other operating systems are not affected.

CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running (moderate)
On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox.
Note: this issue only affects Linux. Other operating systems are not affected.