Lucene search

K
mozillaMozilla FoundationMFSA2016-88
HistoryOct 03, 2016 - 12:00 a.m.

Security vulnerabilities fixed in Thunderbird 45.4 — Mozilla

2016-10-0300:00:00
Mozilla Foundation
www.mozilla.org
48

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.082 Low

EPSS

Percentile

94.2%

An out-of-bounds write of a boolean value during text conversion with some unicode characters.
A bad cast when processing layout with input elements can result in a potentially exploitable crash.
A use-after-free vulnerability triggered by setting a aria-owns attribute
A use-after-free issue in web animations during restyling.
A use-after-free vulnerability with web animations when destroying a timeline
A potentially exploitable crash caused by a buffer overflow while encoding image frames to images
Use-after-free vulnerability when changing text direction
Use-after-free vulnerability when manipulating SVG format content through script
Due to flaws in the process we used to update “Preloaded Public Key Pinning” in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.
URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure.
Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Thunderbird ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

CPENameOperatorVersion
thunderbirdlt45.4

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.082 Low

EPSS

Percentile

94.2%