Lucene search

K
mageiaGentoo FoundationMGASA-2018-0480
HistoryDec 16, 2018 - 12:29 a.m.

Updated thunderbird packages fix security issues & bugs

2018-12-1600:29:48
Gentoo Foundation
advisories.mageia.org
21

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.33 Low

EPSS

Percentile

97.0%

- Buffer overflow using computed size of canvas element. (CVE-2018-12359) - Use-after-free when using focus(). (CVE-2018-12360) - Integer overflow in SwizzleData. (CVE-2018-12361) - Integer overflow in SSSE3 scaler. (CVE-2018-12362) - Media recorder segmentation fault when track type is changed during capture. (CVE-2018-5156) - Use-after-free when appending DOM nodes. (CVE-2018-12363) - CSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364) - Compromised IPC child process can list local filenames. (CVE-2018-12365) - Integer overflow in Skia library during edge builder allocation. (CVE-2018-12371) - Invalid data handling during QCMS transformations. (CVE-2018-12366) - Timing attack mitigation of PerformanceNavigationTiming. (CVE-2018-12367) - No warning when opening executable SettingContent-ms files. (CVE-2018-12368) - Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60. (CVE-2018-5187) - Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60. (CVE-2018-5188) - Use-after-free in refresh driver timers. (CVE-2018-12377) - Use-after-free in IndexedDB. (CVE-2018-12378) - Out-of-bounds write with malicious MAR file. (CVE-2018-12379) - Proxy bypass using automount and autofs. (CVE-2017-16541) - Crash in TransportSecurityInfo due to cached data. (CVE-2018-12385) - Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords. (CVE-2018-12383) - Memory safety bugs fixed in Firefox 62, Firefox ESR 60.2, and Thunderbird 60.2.1. (CVE-2018-12376) - HTTP Live Stream audio data is accessible cross-origin. (CVE-2018-12391) - Crash with nested event loops. (CVE-2018-12392) - Integer overflow during Unicode conversion while loading JavaScript. (CVE-2018-12393) - Memory safety bugs fixed in Firefox ESR 60.3 and Thunderbird 60.3. (CVE-2018-12389) - Memory safety bugs fixed in Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3. (CVE-2018-12390)

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.33 Low

EPSS

Percentile

97.0%