1. Home
  2. Security Advisories
  3. Mozilla
  4. MFSA-2019-12

[MFSA-2019-12] Security vulnerabilities fixed in Thunderbird 60.6.1

Severity Critical
Affected Packages 1
Fixed Packages 1
CVEs 2
Info Packages References Vulnerabilities

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

  • CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information (critical)
    Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow.

  • CVE-2019-9813: Ionmonkey type confusion with proto mutations (critical)
    Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write.

Package Affected Version
pkg:mozilla/Thunderbird < 60.6.1
Package Fixed Version
pkg:mozilla/Thunderbird = 60.6.1
ID
MFSA-2019-12
Severity
critical
URL
https://www.mozilla.org/en-US/security/advisories/mfsa2019-12
Published
2019-03-25T00:00:00
(5 years ago)
Modified
2019-03-25T00:00:00
(5 years ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:mozilla/Thunderbird Thunderbird < 60.6.1
Fixed pkg:mozilla/Thunderbird Thunderbird = 60.6.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date