9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.01 Low
EPSS
Percentile
83.1%
Severity: Critical
Date : 2017-11-30
CVE-ID : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830
Package : thunderbird
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-530
The package thunderbird before version 52.5.0-1 is vulnerable to
multiple issues including arbitrary code execution and same-origin
policy bypass.
Upgrade to 52.5.0-1.
The problems have been fixed upstream in version 52.5.0.
None.
Several reported memory safety bugs have been found in Firefox before
57.0 and Thunderbird before 52.5. Some of these bugs showed evidence of
memory corruption and with enough effort some of these could probably
be exploited to run arbitrary code.
A use-after-free vulnerability can occur in Firefox before 57.0 and
Thunderbird before 52.5 when flushing and resizing layout because the
PressShell object has been freed while still in use. This results in a
potentially exploitable crash during these operations.
The Resource Timing API in Firefox before 57.0 and Thunderbird before
52.5 incorrectly revealed navigations in cross-origin iframes. This is
a same-origin policy violation and could allow for data theft of URLs
loaded by users.
A remote attacker is able to bypass same-origin policy restrictions or
execute arbitrary code on the affected host.
https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1394530%2C1369561%2C1411458%2C1400003%2C1395138%2C1408412%2C1393840%2C1400763%2C1339259%2C1394265%2C1407740%2C1407751%2C1408005%2C1406398%2C1387799%2C1261175%2C1400554%2C1375146%2C1397811%2C1404636%2C1401804
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
https://bugzilla.mozilla.org/show_bug.cgi?id=1406750
https://bugzilla.mozilla.org/show_bug.cgi?id=1412252
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
https://bugzilla.mozilla.org/show_bug.cgi?id=1408990
https://security.archlinux.org/CVE-2017-7826
https://security.archlinux.org/CVE-2017-7828
https://security.archlinux.org/CVE-2017-7830
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | thunderbird | < 52.5.0-1 | UNKNOWN |
bugzilla.mozilla.org/buglist.cgi?bug_id=1394530%2C1369561%2C1411458%2C1400003%2C1395138%2C1408412%2C1393840%2C1400763%2C1339259%2C1394265%2C1407740%2C1407751%2C1408005%2C1406398%2C1387799%2C1261175%2C1400554%2C1375146%2C1397811%2C1404636%2C1401804
bugzilla.mozilla.org/show_bug.cgi?id=1406750
bugzilla.mozilla.org/show_bug.cgi?id=1408990
bugzilla.mozilla.org/show_bug.cgi?id=1412252
security.archlinux.org/AVG-530
security.archlinux.org/CVE-2017-7826
security.archlinux.org/CVE-2017-7828
security.archlinux.org/CVE-2017-7830
www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
www.mozilla.org/en-US/security/advisories/mfsa2017-26/
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.01 Low
EPSS
Percentile
83.1%