Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service Exploit

There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric. I've been able to construct an X.509 certificate that triggers the bug. I've found that...

Security vulnerabilities fixed in - Thunderbird 68.1.1 — Mozilla

A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted...

PT-2019-5249

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.1.1 Description The issue is related to insufficient input validation in the handling of S/MIME messages. Specifically, a crafted message with an inner encryption layer and an outer SignedData layer could be...

Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service

Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric. I've...

Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service

There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric. I've been able to construct an X.509 certificate that triggers the bug. I've found that...

MGASA-2019-0285 Updated thunderbird packages fix security vulnerabilities

The updated thunderbird packages fix security issues: Covert Content Attack on S/MIME encryption using a crafted multipart/ alternative message. CVE-2019-11739 Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9. CVE-2019-11740...

Information Disclosure

thunderbird is vulnerable to information disclosure. Encrypted S/MIME parts in a malicious multipart/alternative message can leak plaintext when included in a a HTML reply/forward...

CentOS Update for thunderbird CESA-2019:2773 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nextcloud: Only the file extensions are checked, not the MIME types as configured

The tool is not working as hoped. File access control speaks of MIME types that are blocked or not blocked. In fact, only the file extensions are checked. If a user renames an unauthorized file to an allowed file, he can upload and download it. The MIME type of the current file is insignificant,...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird 68.1 and Thunderbird 60.9...

Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird 68.1 and Thunderbird 60.9...

Debian: Security Advisory (DLA-1926-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190918)

This update upgrades Thunderbird to version 60.9.0. Security Fixes : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message CVE-2019-11739 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozill...

Debian DLA-1926-1 : thunderbird security update

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message. For Debian 8 'Jessie', these...

thunderbird security update

CentOS Errata and Security Advisory CESA-2019:2773 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

[SECURITY] [DLA 1926-1] thunderbird security update

Package : thunderbird Version : 1:60.9.0-1deb8u1 CVE ID : CVE-2019-11739 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11752 Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site...

CVE-2019-16216

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

Cross site scripting

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

CVE-2019-16216

Zulip server before 2.0.5 (local uploads) and before 2.0.5 (S3 uploads) mishandled MIME type validation for uploaded files, enabling a stored XSS across logged-in users. On local uploads, the attack affects browsers without CSP support (e.g., IE11); on S3, the impact is limited to the configured ...