[MFSA-2020-33] Security Vulnerabilities fixed in Thunderbird 78.1

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 10

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (high)
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script.
CVE-2020-15653: Bypassing iframe sandbox when allowing popups (moderate)
Mozilla developer Anne van Kesteren discovered that <code><iframe sandbox></code> with the <code>allow-popups</code> flag could be bypassed when using <code>noopener</code> links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content.
CVE-2020-15654: Custom cursor can overlay user interface (low)
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work.
CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy (high)
Mozilla Developer Rob Wu discovered that a redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information.
CVE-2020-15656: Type confusion for special arguments in IonMonkey (moderate)
JIT optimizations involving the Javascript <code>arguments</code> object could confuse later optimizations.
This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity.
CVE-2020-15657: DLL hijacking due to incorrect loading path (low)
Firefox could be made to load attacker-supplied DLL files from the installation directory.
This required an attacker that is already capable of placing files in the installation directory.

Note: This issue only affected Windows operating systems. Other operating systems are unaffected.

CVE-2020-15658: Overriding file type when saving to disk (low)
The code for downloading files did not properly take care of special characters,
which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog.
CVE-2020-15659: Memory safety bugs fixed in Thunderbird 78.1 (high)
Mozilla developers and community members Natalia Csoregi, Simon Giesecke, Jason Kratzer, Christian Holler, and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (moderate)
Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.
CVE-2020-6514: WebRTC data channel leaks internal address to peer (high)
WebRTC used the memory address of a class instance as a connection identifier.
Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR.

Package	Affected Version
pkg:mozilla/Thunderbird	< 78.1

Package	Fixed Version
pkg:mozilla/Thunderbird	= 78.1

ID

MFSA-2020-33

Severity

high

URL

https://www.mozilla.org/en-US/security/advisories/mfsa2020-33

Published

2020-07-28T00:00:00
(4 years ago)

Modified

2020-07-28T00:00:00
(4 years ago)

Other Advisories

Source	# ID	Name	URL
Bugzilla	1634872		https://bugzilla.mozilla.org/show_bug.cgi?id=1634872
Bugzilla	1521542		https://bugzilla.mozilla.org/show_bug.cgi?id=1521542
Bugzilla	1648333		https://bugzilla.mozilla.org/show_bug.cgi?id=1648333
Bugzilla	1645204		https://bugzilla.mozilla.org/show_bug.cgi?id=1645204
Bugzilla	1647293		https://bugzilla.mozilla.org/show_bug.cgi?id=1647293
Bugzilla	1644954		https://bugzilla.mozilla.org/show_bug.cgi?id=1644954
Bugzilla	1637745		https://bugzilla.mozilla.org/show_bug.cgi?id=1637745
Bugzilla	1550133	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1550133
Bugzilla	1633880	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1633880
Bugzilla	1643613	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1643613
Bugzilla	1644839	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1644839
Bugzilla	1645835	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1645835
Bugzilla	1646006	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1646006
Bugzilla	1646787	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1646787
Bugzilla	1649347	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1649347
Bugzilla	1650811	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1650811
Bugzilla	1651678	Memory safety bugs fixed in Thunderbird 78.1	https://bugzilla.mozilla.org/show_bug.cgi?id=1651678
Bugzilla	1635293		https://bugzilla.mozilla.org/show_bug.cgi?id=1635293
Bugzilla	1642792		https://bugzilla.mozilla.org/show_bug.cgi?id=1642792

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:mozilla/Thunderbird		Thunderbird	< 78.1
Fixed	pkg:mozilla/Thunderbird		Thunderbird	= 78.1

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date