opensuse-su-2018:0256-1
Vulnerability from csaf_opensuse
Published
2018-01-27 21:50
Modified
2018-01-27 21:50
Summary
Security update for MozillaThunderbird

Notes

Title of the patch
Security update for MozillaThunderbird
Description of the patch
This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). These security issues were fixed: - Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found. - Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices - Calendar: Unintended task deletion if numlock is enabled
Patchnames
openSUSE-2018-101
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for MozillaThunderbird",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for MozillaThunderbird  to version 52.6 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2018-5095: Integer overflow in Skia library during edge builder\n  allocation (bsc#1077291).\n- CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).\n- CVE-2018-5097: Use-after-free when source document is manipulated during XSLT\n  (bsc#1077291).\n- CVE-2018-5098: Use-after-free while manipulating form input elements\n  (bsc#1077291).\n- CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).\n- CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).\n- CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).\n- CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).\n- CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right\n  (bsc#1077291).\n- CVE-2018-5089: Various memory safety bugs (bsc#1077291).\n\nThese security issues were fixed:\n\n- Searching message bodies of messages in local folders, including\n  filter and quick filter operations, not working reliably: Content\n  not found in base64-encode message parts, non-ASCII text not found\n  and false positives found.\n- Defective messages (without at least one expected header) not shown\n  in IMAP folders but shown on mobile devices\n- Calendar: Unintended task deletion if numlock is enabled\n  ",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2018-101",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2018_0256-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2018:0256-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BDMR3YENC7V5BUBRGJXWANWHWNBW46OF/#BDMR3YENC7V5BUBRGJXWANWHWNBW46OF"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2018:0256-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BDMR3YENC7V5BUBRGJXWANWHWNBW46OF/#BDMR3YENC7V5BUBRGJXWANWHWNBW46OF"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1077291",
        "url": "https://bugzilla.suse.com/1077291"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5089 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5089/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5095 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5096 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5096/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5097 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5097/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5098 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5098/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5099 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5099/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5102 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5102/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5103 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5103/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5104 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5104/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5117 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5117/"
      }
    ],
    "title": "Security update for MozillaThunderbird",
    "tracking": {
      "current_release_date": "2018-01-27T21:50:06Z",
      "generator": {
        "date": "2018-01-27T21:50:06Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2018:0256-1",
      "initial_release_date": "2018-01-27T21:50:06Z",
      "revision_history": [
        {
          "date": "2018-01-27T21:50:06Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaThunderbird-52.6-54.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-52.6-54.1.x86_64",
                  "product_id": "MozillaThunderbird-52.6-54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
                  "product_id": "MozillaThunderbird-buildsymbols-52.6-54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-devel-52.6-54.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-devel-52.6-54.1.x86_64",
                  "product_id": "MozillaThunderbird-devel-52.6-54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-common-52.6-54.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-translations-common-52.6-54.1.x86_64",
                  "product_id": "MozillaThunderbird-translations-common-52.6-54.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-other-52.6-54.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-translations-other-52.6-54.1.x86_64",
                  "product_id": "MozillaThunderbird-translations-other-52.6-54.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 12",
                "product": {
                  "name": "SUSE Package Hub 12",
                  "product_id": "SUSE Package Hub 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-52.6-54.1.x86_64 as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-52.6-54.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-buildsymbols-52.6-54.1.x86_64 as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-devel-52.6-54.1.x86_64 as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-devel-52.6-54.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-52.6-54.1.x86_64 as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-common-52.6-54.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-52.6-54.1.x86_64 as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-other-52.6-54.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-5089",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5089"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5089",
          "url": "https://www.suse.com/security/cve/CVE-2018-5089"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5089",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5089"
    },
    {
      "cve": "CVE-2018-5095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5095",
          "url": "https://www.suse.com/security/cve/CVE-2018-5095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5095",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5095"
    },
    {
      "cve": "CVE-2018-5096",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5096"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 52.6 and Thunderbird \u003c 52.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5096",
          "url": "https://www.suse.com/security/cve/CVE-2018-5096"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5096",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5096"
    },
    {
      "cve": "CVE-2018-5097",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5097"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5097",
          "url": "https://www.suse.com/security/cve/CVE-2018-5097"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5097",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5097"
    },
    {
      "cve": "CVE-2018-5098",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5098"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5098",
          "url": "https://www.suse.com/security/cve/CVE-2018-5098"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5098",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5098"
    },
    {
      "cve": "CVE-2018-5099",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5099"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5099",
          "url": "https://www.suse.com/security/cve/CVE-2018-5099"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5099",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5099"
    },
    {
      "cve": "CVE-2018-5102",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5102"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5102",
          "url": "https://www.suse.com/security/cve/CVE-2018-5102"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5102",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5102"
    },
    {
      "cve": "CVE-2018-5103",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5103"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5103",
          "url": "https://www.suse.com/security/cve/CVE-2018-5103"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5103",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5103"
    },
    {
      "cve": "CVE-2018-5104",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5104"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5104",
          "url": "https://www.suse.com/security/cve/CVE-2018-5104"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5104",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5104"
    },
    {
      "cve": "CVE-2018-5117",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5117"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird \u003c 52.6, Firefox ESR \u003c 52.6, and Firefox \u003c 58.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
          "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5117",
          "url": "https://www.suse.com/security/cve/CVE-2018-5117"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1077291 for CVE-2018-5117",
          "url": "https://bugzilla.suse.com/1077291"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12:MozillaThunderbird-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-buildsymbols-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-devel-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-common-52.6-54.1.x86_64",
            "SUSE Package Hub 12:MozillaThunderbird-translations-other-52.6-54.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-27T21:50:06Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5117"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.