KLA11411 Multiple vulnerabilities in Mozilla Thunderbird

Detect date:

01/29/2019

Severity:

Critical

Description:

1. Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Use-after-free vulnerability can be exploited remotely via specially designed HTML5 stream to cause denial of service.
2. Inter-process Communication (IPC) vulnerability can be exploited remotely via attempt to communicate with the IPC object without validation to bypass security restrictions.
3. Use-after-free vulnerability in the Libical libary in Thunderbird can be exploited remotely via a specially designed ICS calendar to cause a denial of service.
4. Multiple memory corruption vulnerabilities can be exploited remotely to execute arbitrary code.

Affected products:

Mozilla Thunderbird earlier than 60.5

Solution:

Update to the latest version
Download Mozilla Thunderbird

Original advisories:

Mozilla Foundation Security Advisory 2019-03

Impacts:

ACE

Related products:

Mozilla Thunderbird

CVE-IDS:

CVE-2018-185007.5Critical
CVE-2018-185057.5Critical
CVE-2018-185017.5Critical
CVE-2016-58244.3Warning
CVE-2018-185127.5Critical
CVE-2018-185135.0Warning

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.