Security update for Mozilla Thunderbird (moderate)

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base MFSA 2018-16, bsc1098998: - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus -...

CVE-2018-12373

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

CVE-2018-12373

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

CVE-2018-12372

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

Mozilla Thunderbird Security Advisories (MFSA2018-18, MFSA2018-18) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Security vulnerabilities fixed in Thunderbird 52.9 — Mozilla

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. A use-after-free vulnerability can occur when deleti...

KLA11278 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive information. Below is a complete list of vulnerabilities: 1. Buffer overflow vulnerability occurs during rendering of canvas...

PT-2018-3162

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.9 Description The issue is related to the Secure/Multipurpose Internet Mail Extensions S/MIME function in the Thunderbird email client, which lacks protection for certain data. This can allow a remote attacker ...

PT-2018-3161

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.9 Description The issue is related to the decryption of S/MIME parts in HTML messages, which can lead to plaintext leakage when included in a reply or forward. This is due to a lack of protection for certain da...

Nextcloud: Missing X-Content-Type-Options

Nextcloud doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome...

mime module denial of service vulnerability

mime module is a MIME type module. A security vulnerability exists in the mime module. An attacker can exploit this vulnerability to cause a denial of service with untrusted user input...

[SECURITY] Fedora 28 Update: gnupg2-2.2.8-1.fc28

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 27 Update: gnupg2-2.2.8-1.fc27

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

Security Bulletin: OpenSSL security vulnerability issues on IBM Storwize V7000 Unified system (CVE-2013-4353, CVE-2013-6449, CVE-2013-6450)

Summary For the three security issues with openssl that could result in denial of service, a fix is available for IBM Storwize V7000 Unified system. Vulnerability Details CVEID: CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 DESCRIPTION: OpenSSL is used in IBM Storwize V7000 Unified system for providi...

GnuPG Flaw in Encryption Tools Lets Attackers Spoof Anyone's Signature

A security researcher has discovered a critical vulnerability in some of the world's most popular and widely used email encryption clients that use OpenPGP standard and rely on GnuPG for encrypting and digitally signing messages. The disclosure comes almost a month after researchers revealed a...

Security Bulletin: Insufficient control over MIME types in Business Process Manager (BPM) and WebSphere Lombardi Edition document feature (CVE-2014-3075)

Summary You cannot restrict file uploads by MIME type in a document list coach view. As a result, potentially malicious files, such as HTML that contains embedded JavaScript can be uploaded and run in the browser. Vulnerability Details CVE ID: CVE-2014-3075 DESCRIPTION: IBM BPM document managemen...

Microsoft Windows: System Cryptography: Force strong key protection

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winscstrongkeyprotect.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for System cryptography: Force strong key protection for user keys stored on the computer Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

CVE-2018-5164

Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting XSS and other attacks. This vulnerability affects Firefox 60...

CVE-2018-5164

Content Security Policy CSP is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting XSS and other attacks. This vulnerability affects Firefox 60...

CVE-2018-5140

Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This could allow for information leakage of which applications are associated with specific MIME types by a malicious page. This vulnerability affects Firefox 59...