1. Home
  2. Security Advisories
  3. Mozilla
  4. MFSA-2020-26

[MFSA-2020-26] Security Vulnerabilities fixed in Thunderbird 68.10.0

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 6
Info Packages References Vulnerabilities

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

  • CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (high)
    Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash.
    Note: this issue only affects Firefox on ARM64 platforms.

  • CVE-2020-12418: Information disclosure due to manipulated URL object (high)
    Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript.

  • CVE-2020-12419: Use-after-free in nsGlobalWindowInner (high)
    When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash.

  • CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (high)
    When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash.

  • CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (moderate)
    When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user.

  • CVE-2020-15646: Automatic account setup leaks Microsoft Exchange login credentials (high)
    If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker.

Package Affected Version
pkg:mozilla/Thunderbird < 68.10.0
Package Fixed Version
pkg:mozilla/Thunderbird = 68.10.0
ID
MFSA-2020-26
Severity
high
URL
https://www.mozilla.org/en-US/security/advisories/mfsa2020-26
Published
2020-06-30T00:00:00
(4 years ago)
Modified
2020-06-30T00:00:00
(4 years ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:mozilla/Thunderbird Thunderbird < 68.10.0
Fixed pkg:mozilla/Thunderbird Thunderbird = 68.10.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date