KLA12254 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability on Linux can be exploited to cause denial of service.
2. A memory corruption vulnerability can be exploited to cause denial of service.
3. A memory safety vulnerability can be exploited to execute arbitrary code.
4. A use after free vulnerability in media channels can be exploited to cause denial of service.
5. A uninitialized memory vulnerability in canvas can be epxloted to cause denial of service.
6. A memory corruption vulnerability in JIT optimization can be exploited to cause denial of service.

Original advisories

MFSA2021-35

Related products

Mozilla-Thunderbird

CVE list

CVE-2021-29986 unknown

CVE-2021-29988 unknown

CVE-2021-29989 unknown

CVE-2021-29985 unknown

CVE-2021-29980 unknown

CVE-2021-29984 unknown

Solution

Update to the latest version

Download Thunderbird

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Mozilla Thunderbird earlier than 78.13